“When actual control is in the wrong hands, but the legal authority remains with management — criminal liability travels all the way up.”