Is the lack of requirements such as functional and non-functional a risk? If a project has forsaken to undertake a cycle of eliciting and documenting requirements, what level of risk does it introduce, how is this addressed and whom does it sit with?

This sounds like it would be a HUGE risk. Because it is huge, I would escalate it at the highest levels of the organization and it needs to be addressed by the project sponsor and project manager.