A risk owner accepts a moderate risk related to an aging application after determining that mitigation costs exceed the potential loss. Six months later, an internal auditor asks for evidence supporting how this decision was reached. Which of the following would BEST demonstrate that the risk response was properly executed?