There's a very simple legal phrase which is "knew or should have known" - the CEO knew or should have known. It's that simple. If you are the CEO and you did n

There's a very simple legal phrase which is "knew or should have known" - the CEO knew or should have known. It's that simple. If you are the CEO and you did not, you should have, and you are responsible. It doesn't really need to be more complicated to incentivize rooting out evil - if we hold people responsible authorities (those with power) who should have known, they will figure out a way to increase integrity of their organizations instead of spreading accountability through infinity vendors.