Right, but the CEO needs to instill a culture of not cheating. If the CEO has that culture (and can show it - lots of ethics training and other decisions that reinforce the idea that the company doesn't violate those rules) then you go down the chain to the rouge manager who hid his action.

This isn't just a theory. On of my companies competitors (I do not know which, I was just given it as an example) was caught bribing officials in China. After investigation it was decided that it was a rouge manager and not the CEO: they has a policy of not bribing, everyone was trained in recognizing how something (even a meal) could be seen as a bribe, and when other unethical action had been taken in the past the company took action to stop it and treated the whistle-blowers well. The CEO got off because he did everything in his power to ensure this wouldn't happen.