How to find who changed a users' Manager in AD

Question

The attribute "manager" was recently altered for a member of our C-Suite recently. Needless to say the change was unauthorised, so we're trying to find who made what we hope is a genuine mistake ;). We have advanced audit policies configured, and Account Management Audit is enabled. We see eventCode 4738 frequently. However, this audit policy does not appear to cover amendments to the field "manager". We have tested some controlled cases today and nothing.

What should be set to capture changes to this field?

AD running on W2019 in Forest and Domain 2012 Functional Mode.