But it's also wrong to say that an institution and its members are completely separate. They aren't and can't be. There is no institution without members, and there are no members without an institution to be a member of. You've got to deal with them as entangled, and treat them as such. There are
varying degrees of responsibility for acts that we attribute to an institution, because generally we're talking about institutions with internal hierarchies. So for example General Keith Alexander is much more culpable than a random sysadmin. But because of the responsibility-diffusing nature of institutions, no, you can't completely let members off the hook without also letting the institution off the hook.
By the way, about your Mafia/Nazi examples: a zealous prosecutor could easily charge the housekeeper, and the police and FBI would certainly lean on them a bit whilst investigating the boss. That's totally commonplace. Meantime, in the case of the literal Nazis, yes, there were in fact consequences for such people (leaving aside that you've constructed that scenario very poorly).