The Finding the Client Wants Removed
You lead fieldwork at an advisory firm engaged by Meridian Payments, a mid-size card processor, to assess PCI DSS compliance ahead of a sponsor-bank review. In a SIEM export you find log entries showing an engineer copying a 1.8 GB archive from the cardholder data environment to a personal cloud account four months ago, then deleting the local copy. No change ticket, no DLP exception and no approval exists, and the engineer resigned six weeks later. When you raise it, the CISO says it was a sanctioned migration test but cannot produce evidence. The general counsel then asks you to drop the finding from the draft report because it is unverified and could derail a pending acquisition; the engagement letter requires material weaknesses to be reported to the board audit committee. Your managing partner notes the account is worth 2.1 million USD a year and suggests softening the language while the client investigates.
1. What do you do with the finding in the next 48 hours?
Read the worked answer
Treat it as a suspected data breach of unknown scope until evidence says otherwise.
- Preserve the evidence. Export the SIEM records, hash them, and store them outside the client's control in the engagement repository with a timestamp and custodian. Do not rely on the client to keep them; log retention may be short and the client has an incentive to tidy up.
- Test the explanation, not the person. Request the change ticket, DLP approval, migration project plan, destination IP and account ownership, and any post-incident investigation. Check whether the destination cloud tenant belonged to the company. Absence of a ticket is not proof of malice - but it is proof that a control failed, which is a compliance finding regardless of intent.
- Scope it. How many records, what data elements, is the archive encrypted, who else had access to that account, and did any other engineer perform similar transfers? Query the SIEM for the pattern rather than the individual.
- Document now, decide later. The workpaper records the facts, the client's explanation, the evidence for and against it, and the open questions. Findings are not softened by being written later.
- Escalate internally the same day to the engagement partner and the firm's ethics or quality lead, in writing. The commercial relationship is not a factor in this step.
- Notify the audit committee per the engagement letter, with a factual interim note: suspected unauthorised removal of cardholder data, under client investigation, control deficiency confirmed, breach-notification assessment required.
2. How do you respond to the request to drop or soften the finding, and to the managing partner's suggestion?
Read the worked answer
Decline both, clearly, in writing, and offer a legitimate alternative that meets the client's real concern.
Why the request cannot be met:
- The engagement letter defines the reporting obligation, and the obligation is owed to the audit committee, not to the general counsel. A scope restriction that removes a material weakness from a compliance report changes the nature of the engagement.
- 'Unverified' is not a reason to omit; it is a reason to describe the verification status. A finding can be written as 'confirmed control failure with unconfirmed intent and scope' - which is accurate and still a material weakness.
- Softening language for a client under acquisition pressure converts an audit into a marketing document and exposes the firm to professional sanction and the client to sponsor-bank consequences later.
Legitimate alternative to offer: write the finding with precise, evidenced wording, include the CISO's explanation and the fact that supporting documentation was requested and not provided, and sequence a management response alongside it. That protects the client from unfair characterisation without altering the substance.
On the partner's suggestion: restate that independence and reporting duties are not negotiable variables, and route the disagreement through the firm's ethics or risk committee rather than resolving it privately. Record the conversation. If the partner persists, escalate to the firm's general counsel; a 2.1 million USD account does not create a reporting exception, and the firm's own quality review will ask why the workpaper and the report disagree.
3. If the client refuses to escalate to the audit committee, what are your obligations?
Read the worked answer
Refusal by management does not extinguish the obligation - it converts a management matter into a governance matter.
Sequence:
- Escalate directly. Use the engagement letter's audit-committee communication channel, or the independence-protected route defined in the firm's methodology, and address the committee chair. Copy the general counsel so nothing is done behind anyone's back.
- Notify in writing with a deadline. State the finding, the request that was made, and the date by which the firm expects the committee to be informed.
- Consult the firm's general counsel and ethics committee on regulatory reporting duties. As a card processor, Meridian has obligations through its acquirer and card-brand rules; in some jurisdictions a suspected breach also triggers statutory reporting. The firm's duty here is usually to the client's governance body and, where the law requires it, to a regulator - not to the press.
- Consider withdrawal. If the committee is prevented from receiving the report, the firm cannot issue an opinion it believes to be incomplete. Document the reasons, the facts relied on, and the sequence of requests. Withdraw in writing, preserving the workpapers.
- Maintain confidentiality otherwise. Do not discuss the matter outside the firm and the client's governance chain; whistleblowing routes exist for the exceptional case where the client and the regulator are both being deceived.
Throughout, keep the distinction clean: the firm reports facts and control failures, not conclusions about a named individual's intent.