I’ve done freelance work for services that act as ‘crisis PR’ hounds, employed by companies to search for and assess the risk to the client’s reputation of internal (employee) and external threats. I’ve observed that the more money a company has had to spend on any one case, the crosser they are (and most likely give serious sanctions). It’s also my opinion that if it happens across different staff members over, say, the same year, the company client gets more and more fed up (again, tougher sanctions).
I guess I’m saying that the sanctions can come down to context, factors that your DH can’t and won’t ever be party too. From the employee’s perspective there’s an element of ‘luck of the draw’.
I wonder if it would help if your DH, as part of his apology, could say something like ‘I’m now aware how costly even these small incidents can be to a company, in executive time and PR assessment. In a way, my new understanding could make me a better bet as a good worker down the track. I’m sure no training you might give us all will stick in an employee’s mind more firmly than this one incident will stick in mine. I’m not confident that the majority of employees are as aware of the costs and consequences as I am now.’
In the end, the best apologies are those framed from the point of view of the person/company that has been negatively affected or wronged, not merely a ‘mea culpa’ from the wrongdoer. Everyone involved already knows your DH is scared shitless for his job, and feeling sorry for himself. He needs to go in with something new, that speaks to their point of view.
Good luck!