I think part of any kind of punishment needs to center around what they do when it is discovered. Do they immediately comply and return said documents, and support a full investigation, or do they deflect and try to cover up and impede the investigation. The former should still result in a censure of some kind. The latter should be a much stiffer penalty, up to and including jail time.