Of course it is. In a company that size where employees work all across the country it's actually very hard for the CEO to find out about sth like this.

He can only create structures (e.g. internal audit team) that are powerful enough to detect it and report it to him.