I am the most senior technical employee at a small company providing software as a service to other businesses. The company only has about 10 employees, so one of the directors does a lot of the sales & marketing.
One client they are trying to get is funded by local government, so (rightly) has strong security checks as part of their procurement process. One such check is ensuring that we penetration 'pen' test our software.
The director asked me to fill out a procurement document that had been sent to them by the client, including a question about pen testing. I, truthfully, wrote that we had never pen tested our software. (It's worth pointing out at this point that even as the most senior technical employee, I don't have decision making abilities. Decisions are taken by the (non-technical) directors, often in different directions to what I, with a technical background, would take. I've been lobbying to implement stronger security practices such as pen testing since I started at the company in 2020, but that advice has not yet been taken.)
The director was not very happy with the document that I had produced (at one point writing 'what the f***' in their email correspondence with me), and they asked me to rewrite the document with the, quote, "more political" answers that they would provide. They provided me with an answer to the pen testing question that essentially said "we did pen testing when we launched, but haven't done it since". I made sure they were aware that this wasn't true, changed the answer in the document to theirs verbatim, exported a PDF and send it back to them as requested.
At that point, I was confident in my personal ethical position. Yes I had produced a document that was factually inaccurate, but when I sent it, I was very clear that I thought the sections that were not written by me were not accurate. I don't think any reasonable person could interpret this as dishonesty. At no point did I present something as fact that I knew wasn't fact.
The director then chose to forward this to the client, without my "this is not accurate" warning.
The client came back and asked to see evidence of the pen testing that had taken place. The director simply responded with "this is a question for our technical manager, [my name], I'll set up a zoom so you can talk"
I now feel like I'm going to have to defend the company's position "we have pen tested", knowing that it is not true. Which leads to my questions:
Have I done anything fraudulent so far? (To be clear, I'm not looking for legal advice, just opinions from people who may have been in a similar situation.)
If I take this zoom meeting, and toe the company line (which I know to be false), am I committing fraud which I could be personally liable for? (Again, not looking for legal advice, just opinion.)
If this is fraud, how can I explain that I don't want to be a part of this to the directors? And is such an issue worth resigning over?