I work in IT, and my manager is trying to get my coworker and me to submit a falsified security scan to a client of ours. Basically, he wants us to submit a security scan modified to exclude vulnerabilities that were discovered during the scan. This is part of a larger project that we are working on for the client.
My manager reports directly to the company CEO, and the CEO himself is pressuring my manager to get this project done no matter what. The CEO doesn't care if corners are cut or if anything unethical is being done.
For me, the issue is very simple. I will not do what my manager is asking as I find it to be highly unethical. Because this is part of a larger project, I have been working on other things in an attempt to give myself some time to figure out what to do. I am also trying to figure out how to best document what my manager is trying to get me to do, which brings me to my question.
So far, everything that manager has asked me to do related to this has been spoken verbally. I have made several failed attempts to get him to put anything in writing. Yesterday, I asked him in writing what he wanted done with the security scans and he wrote back to me, "we already discussed this, you know what to do."
Because I will be putting my job on the line when I eventually have to tell my manager "no", I want to at least be able to document what my manger has asked me to do. I don't currently have any way to prove that he has even asked that I do something unethical. Is there a better approach that I can take? I am more concerned for my professional reputation than my job.