In this case I do not have the evidence to say that this happened but for completeness there is a risk remediation process in place which is delivered by the Remediation Utility team in Cyber that will/do report and follow-up also open risks logged in Comet. (Comet is the name of the tool which Cybersecurity uses for the end to end workflow for an engagement)