The risks have not been improperly evaluated.
The Risk Assessment results in 2013 had identified 5 Risk Treatmetn Plans. These are RTP-13-001 to TP-13-005 which the risk level is still at Medium. These 5 risks are higher than Risk Acceptance Criteria at Low of the organization.
There was no further Risk Assessment to ensure that the 5 RTPs to be implemented could bring the Risks to acceptable level.