The SOI Application will not modify any configuration file without manual intervention such as edit this event policy through event policy editor etc.
1. Have them monitor these files through UIM application to get an alert when these files were modified
2. It might be worth checking if anti-virus or any other security application causing an issue, even they don't modify these files but when someone trying to edit they will automatically create a backup file
3. Please have them to use Auditor (SOI Console -> Tools -> Auditor) option to understand if anyone altered these event policy files