GDPR Art. 22 automated decision-making: how are you documenting human-in-the-loop?

We're preparing for an external audit and the auditor flagged our loan-scoring pipeline as potentially falling under Art. 22 (automated individual decision-making). The model outputs a risk score, but a human reviewer makes the final call — however, the reviewer overrides the model in only ~3% of cases. The auditor argues this is de facto automated decision-making since the human rarely intervenes meaningfully. How are other teams documenting the 'meaningful human review' requirement? Are you logging override reasons, time spent per review, or just maintaining a policy document? Looking for peer experience, not legal advice.