Without having all the facts related to the specific credit reporting agency, I believe the primary risk here is that you can't demonstrate that you sufficiently examined the company. And that would likely be an audit finding. Depending on your specific industry, you may have also violated regulatory requirements. When it comes to your internal audit, they may also find that your processes are not satisfactory or consistent and ask you to make improvements.
Remember consistency is key, and your processes must be designed to ensure that all processes and activities are conducted consistently and correctly. Those are my thoughts, but I would love to hear from other members.