There are a number of problems with logging boot ops in the audit log:
1) Log records that are queued pending the op that executes to enable audit logging are flushed from the queue before the ops that handles adding log handlers. So the records are flushed to nowhere and don't end up in the log.
2) Extension add ops are dropped.
3) Steps that occur in the RUNTIME stage are logged and they should not be, as they are internal details.
4) Parallel boot ops (i.e. the subsystem stuff) are logged separately.
Verified in EAP 6.3.0.ER4.