The audit library leverages the FastDateFormat class to generate file names based on the current date. Unfortunately, in some cases, it correctly uses the timezone and in others, it just uses the default timezone.
To make matters worse, the test cases attempted to work in all scenarios by picked a fixed timezone of GMT+01:00, but with the scenarios where the timezone wasn't used, it could fail if the current timezone was greater than earlier 7 hours than GMT.
This was due to the fact that the test cases picked a fixed time of Nov 17th at 7 am. When that was converted to a file name with the format MMM-dd2 (ie. Nov-17). In the couple of cases where the timezone wasn't properly used, it defaulted to the current locale, which if you where greater than - 7 hours (ie. Vancouver which is - 8 hours), then the resulting file name would be Nov-16, and thus the test cases would fail.
I'll issue a PR tomorrow that consistently uses the timezone both in the test cases and within the core Audit code.