I like BrowserUK's solution.

Alternatively - as these are system tables and are fairly small, I'd extract the data (via perl, isql, bcp) making sure that each table is always sorted in the same way, and then use plain old diff to get an idea of what is incorrect.

If the problem lies in incorrect role definitions then the number of tables that need to be checked is fairly limited, so doing it this way is reasonable, and can be completed fairly quickly.

Michael