White Papers Unix time. We've recently contributed to several large product and application code audits for major technology companies, and here's some of what we've learned on those jobs. Plan an audit between key milestones, but be aware that these often slip. Try to stick with consistent versions so that you can properly track your findings.
Timing is critical.
Another good idea is to prioritize functional areas of the product or application being audited. From a logistical perspective, a solid issue-tracking system is a requirement for meaningful audits. Make sure to label security issues as distinct from garden-variety bugs so that they are given the proper attention. Although simple problems can be identified with automated validation tools, these products are really just a starting point. They do, however, provide good yardsticks of progress over the life of the code base.