I thought they only have to demonstrate that they took reasonable measures (training, checks and balances, culture, etc.) to prevent an employee from doing some

I thought they only have to demonstrate that they took reasonable measures (training, checks and balances, culture, etc.) to prevent an employee from doing something like that. Being a CEO without that protection would be scary.