You can definitely punish countries as an independent entity: with trading sanctions, refusal to give in on certain diplomatic compromises, or different degrees of military retaliation.
Same with companies: mostly fines, but also limits on how they can operate, additional oversight...
Of course, the consequences trickle down to people, but these punishments are not meant to target any given individual, and if the individuals in charge change, the ones that leave don't necessarily carry the punishment with them.
This makes sense, legal entities like companies are guided by incentives. And it sometimes makes more sense to punish the legal entity to change its behaviour, by imposing disincentives, rather than punishing whichever people are running it at the time.
For example, people within a company might pressure an individual to commit a crime, because even if that individual might get punished, the company may benefit as a whole. But if the company's (financial) survival is at stake, everyone is more likely to collaborate to prevent that situation, including the shareholders, if the punishments are big enough.
The point here is, that for issues like negligence and fraud, the current punishments are not significant enough to act as a real deterrent. The punishment on the companies is too lenient (they can absorb the fines, they are rarely an existential threat), and the punishment on the individuals responsible is too lenient (difficult to attribute culpability, limited liability...).
We do want to figure out how to hold individuals more accountable, as you said, we are just having a conversation about why it works like that right now and what could be changed to improve it.
