I just skimmed the NCAA bylaws and can't find a clear-cut route to severe NCAA sanctions. The conditions of membership and good standing pertain primarily to academics and how money flows through the system. There is no mention of criminal or civil liability issues with employees of the member institutions. There is a catch-all "moral and honorable" integrity clause, but a narrow reading would construe that to mean in athletic dealings only.
The president is ultimately responsible for institutional control - that is the first bullet point in the chapter on institutional control. In this case there is clear loss of institutional control, since the board had to remove the president over athletics issues - but the "control" lost seems to be in areas outside NCAA bylaws.
I think the best chances for strong NCAA action will come from (as Jake suggested in another thread) following the money and access that may have flowed from Sandusky's foundation to the AD.
