Comment by DrScientist

I'd argue that the person running the company in this case is responsible.

Now they may argue that they didn't know - but you can frame the law such that's it's their duty to know and ensure this sort of stuff doesn't happen.

cf Sarbanes-Oxley