Well, the board and management (usu. separate, but sometimes not) are responsible. Joe Shareholder isn’t. Generally speaking I think the culpability is usually determined at the decision-making level- i.e., they’re not likely to go after the board of directors for a day-to-day decision made by some manager. But, in the case of large-scale decisions like the tobacco companies are getting nailed for, that’s board-level culpability.
That’s all a corporation is- it’s a legal ENTITY(not a “person”), that is created for the express purpose of separating someone’s personal liability from that of the corporation. That’s the reason you can sue a company in civil court- it has assets you can get a judgement against. You can’t have a criminal case against a company, since it doesn’t exist in a criminal law sense. But the management and directors do.