There are some ideas and questions about how to see particulat issue in Audit Events. One asked who cleared alert instance, another one asked who enabled NCM on a node. I remember that I didn's see all events I'd like to in some installations I configured.
Please make Audit Events fully customizable to select relevant events for Orion instance according cutomers needs and Oriion modules installed.