SELECT  *
  FROM  DBA_STMT_AUDIT_OPTS
  WHERE AUDIT_OPTION = 'ALTER USER'
/

USER_NAME  PROXY_NAME AUDIT_OPTION SUCCESS    FAILURE
---------- ---------- ------------ ---------- ----------
                      ALTER USER   BY ACCESS  BY ACCESS

SQL> 

select  to_char(password_date,'MM/DD/YYYY HH24:Mi:SS') “Password Change Date”
  from  sys.user$, 
        sys.user_history$
  where user$.user# = user_history$.user#
    and name = 'XXXXXX'
/ 


Password Change Date
--------------------
01/12/2015 11:11:05
12/26/2017 00:32:46
12/26/2017 00:33:34