A penetration test includes multiple important aspects,
A) Before the penetration test, the Company(A) and the Company(P-T) have to define boundaries, what should be tested, what, how, where, when. Sometimes, the company(A) provide a testing laptop, with tools requested by the Penetration Tester. Legal documents are created, to ensure the safety of both companies.
B) Following the legal documents, and the type of penetration testing requested by the company(A), and the one offered by Company(P-T) the penetration tester is going to go step by step to find flaws in the system.
For example, a Penetration Tester might be asked to follow a specific methodology such as ISSAF or OWASP, OSSTMM, NIST following the requirements of Company(A). Some companies(P-T) also have their own and specific methodologies to work with.
Some companies might ask the penetration tester to exploit the vulnerabilities, while some other might only ask the penetration tester to advice possible vulnerabilities, it all depends on their needs. (Having the "exploit" step, is always better, but sometimes it should be avoided, in particular cases)
A penetration test should always be done by someone who knows what he his doing, often some companies try to replicate penetration tests and have problems because of their lack of knowledge (tools, impact etc), their should always be a legal document, an appropriate methodology, and in some cases a supervisor.