The law has answers to this - RICO and Sarbannes-Oxley.

There's a lot of material there, but they basically mean that "I didn't know" is not a defense for management - that it is in fact the CEO's business to know if criminal or negligent things are being done and the state is not required to prove that the manager explicitly knew.

Reagan used RICO on investment bankers, with very great effect, so it isn't just for Mafia druglords.