Normally after a high profile operational risk materialises, the end cost normally determines how high up the food chain the sackings go,but they generally would stay in the first line of defence.
This one therefore stood out for me as a bit of a outlier. I'm all for individual and collective responsibility, and would personally have fallen on my sword if I was within a square mile of this abomination regardless of my job spec. However, is it correct to dismiss the CRO because of an internal control failing (albeit a whopper!)?