If you're contracting with a company to pen test and audit your app, you will be wise to scope out exactly what is in the limits of said test, what will be tested and how (it appears you are giving them source to be able to white-box test as well). They will likely work with you to establish the legal agreements that indemnifies them. It should also spell out the expected outputs, the timeframes and methods they will communicate the results to you. All of these things are just ways to make sure you are getting exactly what you expect from them. This is in their best interest too; they want happy customers as well.
Aside from the legal/contractual matters you would be wise to give them an environment as close to or the same as your production one so that the findings are accurate and also if you can perform your own testing ahead of time to remove the "low hanging fruit"- that is, anything that is easy for them to find. Consider code reviews and system design reviews ahead of time to give them what you think is your best. That way you are getting your money's worth.