The company can through them, but it's the company, so the company can't be imprisoned. But you're right that obviously the actions would be committed by an individual, and the company would have an obligation to identify the individual so that individual could be prosecuted. It's not at all a way of getting individuals off the hook. One of the objectives, in fact, is to try to identify conduct more easily.
The idea behind offering an incentive to the company is that it would help detect wrongdoing.