Legal process, discovery, and corporate records.

Require more accountability if a company wants to enjoy the benefits of incorporation. Decision processes have to be documented and responsibilities clearly delineated. Employees have the opportunity and duty to ensure their work is correctly described.

The current system isn't working, it's producing too much abuse.

Or, we collectively decide that it’s unlikely scandals of this scope did not previously pass the CEO’s desk at some point in the timeline and start with penalties at the top, and then move down the line.

My argument can be expanded to the fact that if a “rogue underling” did this without C-level input that leadership at the company is negligent at the least, or attempting to abstract responsibility and hide the issue behind deniability at the worst.

Addendum: I should have picked a better phrase to start with. I agree that the legal process is the correct way to proceed, but once a determination of culpability is made, hiding behind layers of leadership should not be the defacto norm.