Record rationale, approver, scope, compensating measures, expiry date and the evidence required for review. Apply this specifically to documented requirements, secure integration, interoperability, lifecycle cost and measurable control outcomes. Record the owner, evidence, decision and review date so another qualified person can verify the result.