I would expect that only root or someone you have granted sudo rights to these commands would be running them. What users are you wanting to audit?
A successful shutdown, halt, and reboot should be logged in the AIX error report. As for the unsuccessful ones I am not aware of a log for that but you could write you a wrapper script and within that script log what id executes that script.
We do that for password changes. We have over 200 little groups of people and there is an admin assigned to each group to reset password.
I hope this helps,
Justin