The question is should the CEO have know. A CEO that trys to set a culture of doing the right thing, with training on what the right thing is, and other such things can still be deceived by someone low level who cheats. It is possible for one person to cover their tracks for a long time if they are trying to cheat. It can be years to track down who is doing the immoral thing even after you catch something is wrong.

The question this is this one person (or small group) operating against their instructions, or is it the CEO encouraging people to cheat? That can be a hard question, but we want CEOs to think if I do "enough" (whatever that is) to ensure we obey the law I'm okay and thus I want to ensure enough is done. There are always crooks in the world, we want to ensure they are not encourged. If the CEO is always at fault their thought is likely to go to how can I ensure that tracks are covered so they nobody can be convicted.