Probably nobody identifiable, or a large class of people. It pretty clearly causes increased organizational fitness in the current social / regulatory / legal

Probably nobody identifiable, or a large class of people. It pretty clearly causes increased organizational fitness in the current social / regulatory / legal environment. . The solution is not increased punishment for customer-facing people, since that would just put them in a "damned if you do, damned if you don't" situation. Something along the lines of RICO or Sarbanes-Oxley might help, since it would give strong personal incentives to the people who actually have power to set procedures and organizational culture. Something that has definitely hurt, is the demonization of (and organizational liability for) individual initiative and discretion. There does seem to be something a bit odd in making both leadership personally liable for bad outcomes of following policy, and the organization liable for bad outcomes of not having a strict enough policy.