I don't think it's all that different than if I'm an employer and my employee does something illegal. An investigation can be made as to whether the acted on their own acted based on what the directions or prevailing understanding was at the company. That may change who is responsible in part or in whole and what steps need to be taken to provide recompense to those impacted by that illegal activity.
Every situation will be complex and unique in its own way. That's what courts are for, determining the unique aspects of a case and making specific ruling based on the law and the situation, as the judge (in determining what is acceptable and willing to be seen) and jury (to determine whether someone needs to be held accountable and to a degree how) see fit.