The ESRB Ratings Process walkthrough describes the steps to get a physical boxed game rated:
Physical (e.g., boxed) games typically sold at retail are rated using a "Long Form" process whereby ESRB raters evaluate the content of each game in advance of its public release. In these cases the publisher must provide two key forms of content disclosure as their game is being finalized: 1: a completed ESRB online questionnaire detailing the game's pertinent content, which essentially translates to anything that may factor into the game's rating. This includes not only the content itself (violence, sexual content, language, controlled substances, gambling, etc.), but other relevant factors such as context, reward systems and the degree of player control; and 2 a video that captures all pertinent content, including typical gameplay, missions, and cutscenes, along with the most extreme instances of content across all relevant categories. Pertinent content that is not playable (i.e., "locked out") but will exist in the game code on the final game disc must also be disclosed. Once checked to ensure that all pertinent content disclosed in the completed questionnaire is reflected in the video submitted, the video is reviewed by a group of at least three trained raters who collectively deliberate about what rating should be assigned.
For digital games, the ‘Short Form’ process is similar.
Implicit in all of this is the idea that you will fill out the questionnaire honestly, and that you will submit video footage indicative of questionable game content.
But what if you didn’t? What if a game like, say, GTA ‘marketed’ itself to ESRB as an open-world life simulator, and totally left out the violence/theft/etc. when submitting their materials? When the organization found out the developers lied, what exactly would happen?