What professional standards and practices are recommended for guiding such an effort?
closed as not a real question by Rook, Antony Vennard, AviD♦ Apr 19 '12 at 18:12
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
As mentioned in the comments, likely for this the best option would be to get in an external company with expertise in this area, if it's something your organisation doesn't have experience of. That said there's several things you could consider in terms of what you want to get from the review which could help you get the right company and commission the right piece of work, some things to consider :-
Good place to start is OWASP project. In this case I think that OWASP ASVS may come in handy. You can verify your application on L2A or L2B level since you have access to source code.
Unfortunately you probably won't be able to properly test your application if you don't have any experience in this area, so hiring someone is really good move. Of course even if you hire someone you need to specify the goal of this test (saying "I want by application to be secure" is not a good idea), and again - in my opinion - using ASVS as a checklist is really good choice.