Windows Security Log Events by ID

This indicates the system's audit policy was modified. Pluses indicate auditing was enabled, minuses indicate it was disabled. Unfortunately the Change By fields don't identify who actually changed the policy because audit policy isn't directly configured by administrators. Instead it is edited in a group policy object which then gets applied to the computer. Therefore this event always shows the local computer as the one who changed the policy since the computer is the security principal under which gpupdate runs.