I was thinking a custom record would make sense - we could trigger emails and show the audit trail and all that jazz.