Are you asking who makes the final decision, or who decides for the company whether to treat an error as properly corrected? The second question is a practical matter that every company will have to resolve for itself. With respect to the first question, the IRS would generally be the final arbiter of whether self-correction was properly completed if/when they happen to notice the issues on audit.
In theory, there could be a fiduciary or ERISA breach underlying just about any operational or documentary failure, which would need to be separately corrected to the extent possible under DOL procedures (which are rather lacking in this regard). The DOL could determine that a self-correction was insufficient under IRS procedures and therefore give it no credit with respect to the underlying ERISA/fiduciary breaches (to the extent that it would receive credit in the first place), and thus impose further penalties. There could also be a participant lawsuit, but that would generally be grounded on Title 29 ERISA violations, not on breaches of the tax code, and in any event, EPCRS corrections technically offer no protection against participant lawsuits (except, perhaps, to the extent that the participant has been substantively made whole as part of the correction) regardless of whether the correction complied with EPCRS.