Keep the requirement connected to the process and owner it applies to.
Policies, controls, review requirements and recurring obligations can be connected to responsible teams, systems, files and schedules so compliance is part of operating work rather than a disconnected checklist.