What strategies do you employ to analyze and document suspicious activity in transaction monitoring?