Yes, I believe the legal criteria is "known or should have known" that it was happening.

If the C-level knew, they were criminally culpable. If they didn't know, they were criminally negligent.