Most audit logs say what happened; almost none can say why it was allowed. The difference is the policy version and the approver, kept next to the event in the Audit Vault.