This is more compliance-related than information-governance-related. But the link between the two is strong.
How do you set the tone at the top of an organization? One way is to prosecute senior managers.
“Criminal Trials of Former Health-Care Executives Set to Begin,” The Wall Street Journal, May 23, 2016 B1. A former division president and two former senior officials are going to trial, facing allegations of health-care-related crimes.
This is consistent with the Yates memo from September 2015, which said that the Department of Justice will be looking to prosecute more individuals for corporate crimes.
Is this a necessary part of the business case? Is compliance with law substantially different from compliance with company policy? If employees – senior or junior – violate the law, they may be prosecuted. If they violate company policy, should they be disciplined or dismissed, and perhaps sued as well?