SharePoint Audit Policy:
Security Change
This audit flag corresponds to the "Editing users and permissions" check box on
the "Site collection audit settings"
page in Site Collection Administration.
These events document access control related changes to groups, permissions and
site collection administrators.