Two reasons I can think of. Legally an organisation is usually exposed in relation to its scale, even if the misconduct was limited to one employee trusted to

Two reasons I can think of. Legally an organisation is usually exposed in relation to its scale, even if the misconduct was limited to one employee trusted to carry out work independently, the penalty will likely be related to the total size of the company. The second is if you're scale is large enough that you are considering a significant portion of the employees with some skill in a region, you have a harder time selecting for anything other than "holds a qualification" during hiring. This leads to all sorts of policy to prevent someone with qualifications but less integrity causing issues.