Collective punishment incentivises the company to put safeguards into place. Papertrails for all decisions, four eyes principle, transparency etc.

Corporations are people, right? Punish the person. The corporation can decide whether to shift the punishment down to the responsible people (conduct their own internal investigation to find the responsible people, and punish them appropriately), and work towards a structure where these things won't happen or can be detected early.