They must have signed off this as their acceptance during risk assessment, if not they should take this as lesson to do more evaluation in the future.