No. There is no such thing as vicarious criminal liability.
Anyone convicted of a crime needs to be personally involved and have knowledge of the relevant facts for co-conspirator or solicitation liability.
There isn't really a single law that says it. It is rooted in the overall structure of the criminal codes at the state and the federal level, and in the elements of each of the possible crimes.
Section 302 of the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7241), requires a CEO to certify that its financial statements are materially correct to the best of the knowledge of the CEO, and also that certain internal controls are, or are not, in place, to the best of the knowledge of the CEO. Regulations address whom the CEO is entitled to rely upon in acquiring the knowledge that the CEO has when certifying the disclosures that are made under the Act. And, Sarbanes-Oxley imposes duties on lawyers and others to inform he CEO of irregularities. But the CEO is not subject to criminal or civil liability without having knowledge of errors or omissions in these statements that are contrary to the certification.