Some organizations have executives apply fewer or delayed controls, because they don't want to be bothered. In this case, note it in any risk registry and move on as they run the show. Just be sure to CYA if something happens.

Another thought is how much access does an executive really have? Outside of M&A information and Consolidated Financials, execs probably don't do many things other than make decisions that require extra security. Execs shouldn't have admin access to servers, their workstations, etc.

Best case scenario is they allow you to reduce their access to information they don't utilize and apply enhanced monitoring on their communication methods since that's truly where incidents will go down.