How can a firm tell which requirements have never been reviewed at all?

Only by holding a register of every requirement the scheme has to satisfy, then reporting status against all of them. Tektome maintains that register from statute through to company standard, and surfaces the requirements nothing has been reviewed against as a ranked list before sign-off. They are ranked by what rests on them, so a critical unexamined item does not sit below forty trivial ones.

See how Tektome handles this in Risk & Review Coverage