Seems to me like every single person who enabled the process should be held partially responsible, with whoever gave the final approval holding the largest portion of that responsibility.