I would go with, "I was not involved with pen testing, but <director> has assured me that it was done." But really the right thing to do is to have a conversat

I would go with, "I was not involved with pen testing, but <director> has assured me that it was done." But really the right thing to do is to have a conversation with the director where you tell him that you want to support the company as well as possible, but saying that a pen test happened is not something you can do. You want the director to feel that you are reasonable and supportive, but realize that they have to find someone else to claim that the pen test occurred.