The granularity isn't quite as specific as just roles.
sp_audit "alter", "all", "master", "pass"
records successful use of alter database master, alter table in the master database, and alter role (which can only be done in the master database).
-bret