I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit.
For instance, OWASP Testing Guide could be used for both of those cases.
Let's say the pentester and the auditor are working inside the enterprise: they therefore have access to the same resources ie architectures, documentation, etc.
I understand that for a pentester, exploiting a vulnerability is the ultimate goal. But, it looks like the process of discovering the vulnerability for both the pentester and the auditor is the same.
Consequently, the auditor job may look like a vulnerability assessment.