Write up a resolved incident — what went well, what went wrong, recommendations — assign follow-up action items, and sign it off as the regulatory record. One review per incident.
Responding to an incident is half the job; learning from it is the other half — and for regulated teams, recording that you did so is a duty, not a nicety. An after-action review (AAR) captures what happened, what worked, what didn't, and what you'll change, attached permanently to the incident it's about.
A review usually surfaces things to fix — a door that should have been locked, a contact list that was out of date. Capture each as an action item with an owner, a priority and a due date, and track it from open through to done. The lessons don't get lost the moment the review is filed.
checksums.sha256 file lists a SHA-256 for every file and manifest.sha256 seals the manifest, so anyone can verify with standard tools (sha256sum -c) that nothing has changed since export. A recording the exporter may not hear, or one no longer held, is listed as missing rather than left out silently. Every export is recorded in the audit log, and every clip in a pack is recorded in the recording access log.