The CSR (Certificate Signing Request) is what you send to the Certificate Authority to request that they issue you a certificate. It's just a copy of the public key and some ancillary information.
Sending the CSR without your client giving it a kiss of approval does not affect the functionality of the signed certificate and public/private key pair (though if the information in the request is incorrect - for example if it has an old address for your client - they may take exception to that and as you to have the error fixed).
Many companies offer what your guy did as a service (managing the SSL certificate renewal process and sending it the CA on behalf of the client), particularly if the client is non-technical and would be intimidated by the process of sending the CSR to a Certificate Authority to be signed. It can be a huge time-saver if you would otherwise have to hold your client's hand through the process.
Regarding who foots the bill, if your contract says the CSR has to go to the client for approval you screwed up. Discuss it with the client, but be prepared for them to refuse to pay you for your screw-up (this would be somewhat unreasonable in my opinion, and if they refused to pay on the grounds that you shouldn't have done it I would not install the certificate: Re-do the process following their procedure and eat the loss on the extra certificate that you'll have to throw away).
If your contract doesn't require the client to approve the CSR, I would suggest invoicing the client for the cost of the renewal as a service you performed for them.
If you don't have a contract, invoice them for the service AND draft a contract for services to be provided :-)
If this is not a service you want to provide in the future you should make it clear to your client that it was done in error, and in the future the CSR will be sent to them to be forwarded to the CA of their choice for signing.
