> They can look at the company's actions

This would work if we could punish wrongdoing regardless of intent, a standard probably reasonable against companies (they should know better after all). But this is not how it usually goes: Usually incompetence has to be ruled out and criminal intent has to be proven.