The Founder's Emergency Changes

You describe the control as designed and then state plainly that it did not operate effectively in the period, with the exception rate and the concentration in emergency changes.

Why there is no alternative:

• Misrepresenting a control environment to an auditor is not a risk trade-off, it is fraud, and it exposes the company, the CEO, and you personally. It also destroys the only asset you have in this role - the credibility of your findings.
• It would not even work. The auditor already has the sample. Your description is being tested against evidence they hold.
• The customer addendum requires documented change control. A clean report obtained by concealment still leaves you out of compliance with the addendum, and now with a misrepresentation on top of it.

The professionally useful move is to shape the finding, not to hide it. Present it as: root cause is an undefined emergency-change path plus a standing exception for one privileged account, not a culture of ignoring change control. Propose a remediating control (retrospective review of emergency changes within 24 hours, logged and approved by a second person) that can be evidenced in the next observation window. Auditors respond to a credible remediation plan; they do not respond to a denial they can disprove.

Lead with money and control, not principle - the CEO is a founder who optimizes for speed and will hear "compliance" as overhead.

The ask, in priority order:

1. MFA on the production account today. This is the cheapest, fastest item and the one a customer's due-diligence team will find first. Frame it as: the exception saves you seconds per login and buys a 38%-of-ARR customer clause violation.
2. Remove saved production credentials from the browser; move to a privileged access vault with checkout and logging.
3. Define an emergency change path that works - a documented pre-approved procedure the CEO can invoke at 2am, with retrospective review within 24 hours. This respects the real requirement (speed during incidents) instead of fighting it. That is how you get a founder to sign.
4. Least privilege for the CEO's day-to-day account; keep a separate break-glass account.

The fallback: if only one thing moves, take MFA and the vaulted credentials, and log the emergency-change gap as a compensating detective control (weekly review of all production changes) so the auditor sees something operating.

Bring the $600K and the 30-day clock into the room. Do not bring the phrase "segregation of duties" into the first sentence.

Sequence matters - go from cheapest to most costly, and document each step as you go.

1. Recap in writing. A short, non-inflammatory memo restating the decision, the specific risks, and who owns them. This converts a hallway conversation into a record. It is not escalation; it is professionalism.
2. Escalate to the board or audit committee, if one exists. Governance bodies exist precisely for the case where management is the exception. If there is no board, the investor director is the route.
3. Refuse to sign the management assertion if you are asked to attest to a control environment you know is not operating. You can support a report with a qualified opinion or an exception; you cannot support a false one.
4. Assess the customer obligation. If the addendum requires you to notify of material control failures, get legal's read on whether the 30-day cure clock is already running and whether self-disclosure beats discovery. Self-disclosure with a remediation plan is usually survivable; discovery is usually not.
5. Resignation is the last option, not the second. It fixes nothing for the customers whose data is exposed and it removes the only person arguing for the fix. If you do reach it, resign in writing with the reasons on record.

What you must not do at any step is tell the auditor something you know to be untrue. That line does not move for budget or for tenure.