I think this is the way to go as well. He might have simply said he wasn't at the firm when the pentesting was carried out and he would search for the documenta

I think this is the way to go as well. He might have simply said he wasn't at the firm when the pentesting was carried out and he would search for the documentation. He should have sent emails to his managers about where he could obtain the initial pentesting documentation.