This. Outside in, company is liable. Internally speaking, everyone from the employee, up the management chain has culpability for not mitigating a reasonably foreseeable risk.

As it turns out, if you hold people to an standard of reasonable forseeability, and don't let them set the goalposts at 2nd degree arbitrarily, there isn't much you can actually get away with. The steps aren't hard to manage when you actually take the time to think about them.