The problem with that is a company can have many parts - fining the entire company for one dept will discourage large corporations. They'll just restructure and push all the risk to 3rd-party/contactors.