One crucial thing is to refer to the company's Information Security Policy. These policies will also decide what an employee is allowed and not allowed to do in the company with aspect of IT security. It also decides what will be the penalty if an employee breaches a security policy. So for eg: if the policy says that the company can monitor any one any time, then you can pentest without informing the end user! On the other hand if the policy says that the end users can't be monitored under any circumstance, and if you conduct a pentest then you might be in a trouble.These policies are provided to the employees when they sign the contract. So the employee cannot blame the employer later by saying that he/she was not aware of this fact.
I would highly recommend you to refer to the security policies of the company before conducting a pentest. It will help you to better understand the internal workings of a company and also it will assist you to plan your testing phase:
- It could help you to decide when to test (Business or Non-business hours)
- It will help you to plan your complete pentest in some aspects and to have an idea how long it will take to pentest etc..
Here is a good resource about security policies templates.
Security policies are usually created by keeping in mind the IT laws of the country to avoid any conflicts. For eg: An UK based company's security policies will be created by keeping in mind the UK IT laws.
One other example could be that some companies have a strict policies that the employees are not allowed to bring any kind of personal device. If an employee brings such kind of device then the company has full right to look into that device as long as it is in company's premises. For eg: An employee can't bring his/her own laptop or mobile phones etc. that is used for the personal use. Suppose an employee brought one such kind of device now as per the security policy the company can look into this device and the owner of the device must fully corporate! (Also: Now you have a one more device to pen test. :P
As there is no universal security policy so different companies might have different security policies. So there is no Yes/No answer to your question.
If the security policy doesn't help in some case then I would recommend to have a discussion with the owner of the company. Usually a person (or a team) with senior technical/non-technical position will be provided to you by the owner to discuss such cases depending upon the context.
Also, it is a good idea to have a contact with some senior technical/non-technical persons during the whole phase of the pentest. These persons will be assisting you in any technical/non-technical matters. Also, as they will be possessing some high positions in the company, so they will have higher authorization and they could provide you clearances in a short time. For an instance, if during the pentest unfortunately something goes terribly wrong, then you can immediately inform these contacts. You could/might have some situations during the pentest, when you have to decide something instantly. Examples of such situations could be that you forgot to plan what to do if a particular situation arises prior to conducting the pentest or a weird situation arises & you unfortunately have no backup plan. At that moment you can again discuss with the contact persons to make better decisions.