I'm sorry I don't have an on-point answer but I just want to mention how painful these situations are for compliance officers. The regulations tell us what to do and when to do it. But in compliance you often get questions like this: "We failed to do it and it was a really, really long time ago too. Now what? You're compliance, so you get to fix it, right?" It's a little like someone having all the instructions for skydiving and copious amounts of time and opportunity to properly prepare, but after your team makes the jump, and as you are all plummeting downwards, someone pipes up with a comment: "I failed to put parachutes in our packs. Your packs have nothing but pots and pans. Oopsie."
These situations are infuriating, challenging, and require some creative thinking about how to address it (usually, numerous steps will be needed, and even then it might not be enough to satisfy your regulators). There is often a lack of clear guidance in the regulations on how to remedy such failures. I hope you get some good answers on here because all I can think of to do is to brace for impact.