I mean personal criminal liability. Not civil or criminal liability absorbed by the larger corporation (though penalties to the corp might be necessary as well)

I mean personal criminal liability. Not civil or criminal liability absorbed by the larger corporation (though penalties to the corp might be necessary as well). Patent law uses the concept of "a person having ordinary skill in the art" (PHOSITA) to determine which patents are novel and which are non-novel. The idea is that if an invention is obvious to a PHOSITA at the time of invention, the invention isn't novel or surprising. I think we could use the same concept in risk management. If, at the time a decision is made, a PHOSITA would say a decision is likely to lead to serious harm, then someone in a leadership position should face criminal liability if that decision later does in fact lead to harm. I think a) who should face the criminal liability, b) what we mean by "likely" c) what we mean by serious harm are all topics you could get into at length. But before you fiddle too much with the knobs on a, b, and c we would probably need to determine if criminal liability is the correct solution. I obviously think so.