Civil and criminal sanctions can be applied to both the individual and/or the institution. For example, Dr. John Reece Roth of was a university professor who was prosecuted for ITAR violations in 2011-12, the university was not officially sanctioned.
The University of Massachusetts at Lowell was fined $100,000 by BIS for shipping EAR99 items (no license required for shipment to non-sanctioned countries/persons/organizations) to an organization on the Specially Designated Nationals List in Pakistan.
Agency penalties may overlap (i.e. BIS, OFAC and DDTC can penalize for different parts of a single incident).