Firstly, I have met very few malicious people in my career. Most of the really destructive people are products of their environments. It is complicated, but it is normally an incentives problem, most commonly status/ power rather than monetary. Often they have created blocking processes that the company sees as some sort of control or policing. It tends to be rather easy to change that if you are their boss. It is harder, but not impossible as a colleague. Often the application of cold hard rigorous logic, an understanding of the real controls etc. Can unstick them.
I work in a 100k person company at the moment (admittedly I'm not in charge of that many of them), so I understand the problem of scale, but I would counter that the changes neede are rather subtle. I think much can be achieved by focusing on the 20 people at the top. Culture cascades. For example if you dig in over a KPI not being achieved, when someone explains that it is counterproductive, or conflicts with another KPI, how do you think they will manage their team in future?
