Government regulators generally hold true corporate officers — those holding titles of vice president and above within the parent organisation — legally accountable for internal control failures. A CIO at division level may or may not qualify as a true corporate officer. Department directors and their subordinates are generally not personally liable to government authorities for control failures; they support the vice presidents above them in the governance hierarchy.