Well it is worth getting them to the documentation in retrospect simply so you can report on all the normal stuff, but add a flag for 'unauthorised' and have a lessons learnt field to give the fundamental reason for the lapse, e.g. lack of training, discipline, third party unaware.