Technically, if they sold products FROM THE USA, containing components MADE or COMMISSIONED WITHIN the USA to a restricted party in Iran! Sooooo, on a technical/legal basis the company DID in fact break US law! The KEY ISSUE is she SHE the CFO know about it and INTENTIONALLY SIGNED OFF on those transactions! If she did, then she get 20 years per count!
If she PERSONALLY had no knowledge of the transactions committed by underlings (who may have acted on their own!), then she merely gets a big fine and loses any position held within the US operations.