Database Auditing: Actions within a application

I have set up Oracle Database Auditing to capture highly privileged application user activity in the following way:

1. Audit their sessions:

AUDIT SESSION BY <username>;

2. Audit their activity:

AUDIT ALL BY <username> BY ACCESS;

When the audited user logs into the database through SQLPLUS then the audit captures the logon / logoff and activity within that session. Perfect.

However when the user logs into the database through the application then the audit only captures the logon / logoff.  No activity is captured.

Is this a limitation of Oracle Auditing or is my configuration wrong?