Answer:
the three of them could be held personally liable:
Explanation:
John committed forgery and possibly fraud by forging clients' signatures on documents held by the company. His boss ordered him to do so, so he is also responsible for John's actions. John can even try to put all the blame on his boss alleging that he was forced to forge the signatures. The CEO of the firm is also responsible because the forged documents had to serve someone's illegal purposes, and the CEO probably was the one that needed them or knew about what was going on and didn't do anything to stop it.