Notice 972CG is only a proposal to assess the penalties at that point, not actually an assessment. Did you respond to the notice within the prescribed time, 45 days? How long has it actually been since your response? Did you follow the procedures for verifying the TINs on file, or trying to obtain the missing ones? There are very specific rules regarding solicitations by the issuer in attempting to rectify this problem.
There is no statute for when the IRS might respond, but it doesn't usually take years. You may think so though if you've had ocassion to call the IRS and be placed on hold these days! Did you try calling?
Generally speaking about notices, the IRS' next step would be to either send another notice either asking for additional information or one actually assessing the additional tax, penalties, and any interest due at that time. Then, if not paid within the prescribed time, it will then send a demand for payment, and if not paid by that due date, then it sends a notice of intent to levy.
Specifically in the case of the 972CG, the next step from the IRS would be either letter 1948C (that either asks for additional information OR documents that the penalty was waived) OR notice CP15/215 that actually assesses the penalty and demands payment. Are you sure that the letter 1948C wasn't received by your company and not routed to you?