Well, the NCAA disagrees with your interpretation. Count 1 in the findings and conclusions of the NCAA criminal jury in regards to the case stated that not only was there inadequate controls, in some instances they were non-existent. The following is verbatim from the Binding Consent Decree Imposed by the NCAA, which was accepted and signed by Penn State.
" 1. A failure to value and uphold institutional integrity demonstrated by inadequate, and in some cases non-existent, controls and oversight surrounding the athletics program of the University, such as those controls prescribed by Articles 2.1 (The Principle of Institutional Control), 6.01.1 (Institutional Control) and 6.4 (Responsibility for Actions of Outside Entities) of the NCAA Constitution. "
The FREEH report, a mere 267 pages and the BINDING CONSENT DECREE are readily available on the net. If you look at the major key findings and the time line of key supporting facts in the report, which is only a few pages for each, and compare those with the responsibilities spelled out in the NCAA's Constitution and Bylaws Articles as referenced in Count 1, it's pretty clear, at least to me, NCAA rules were not only broken but ignored by the school. And I agree with you, three months in Jail is a little short for Spanier, Shultz and Curley.