It may be helpful to look at the CASA Board's charter:
The Board is responsible for deciding the objectives, strategies and policies to be followed by CASA and for ensuring that CASA performs its functions in a proper, efficient and effective manner
I doubt that the board was even aware of what was happening - CASA (the organisation) operates in a management environment where it's difficult for rogue administrators or faulty processes to be bought to account quickly. When they are, and the board does become aware of events, probably due to external factors, the damage has been done, and businesses can fail.
So, in the context of this case, technically, the Board may have failed in it's duties. At board level, ignorance is not a defence, and the expertise on the board should identify processes that lead to dysfunction. However, they would reasonably be entitled to rely on senior management for advice. In reality, it's a joint responsibility.
Just as in the industry as a whole, CASA is employing people who, relatively speaking, have less real world experience than counterparts generations ago. Personal relationships between regulator representatives and industry just don't exist at the same level as in times past, where many issues would have been sorted out away from the spotlight and never got to the level that we now see with Glen Buckley.
CASA's silo management processes, where individual regions make autonomous decisions, beggars belief. As an example, identical applications sent to separate capital city CASA offices receiving opposite decisions. Go figure.
This is an agency in crisis, understaffed, with a few personnel who should not be in the roles they hold, with structures that allegedly provide protection to the end user (Peer review and AAT etc) , but in reality have the opposite effect, where business can fold before restorative justice can take place.
The concern with any individual case is that there may well be adverse findings against CASA, but that will be countered with the very tired and worn argument that most of the individuals concerned have left the organisation.... etc etc. The overriding argument should be that CASA itself has no capacity for effective self monitoring and that internal review processes lack robustness, independence and fairness.
Where CASA is found to be at fault, financial penalties must apply to the regulator.
Cost recovery needs to work in both directions.