WebApp Sec: Recommendations for web app test?

["App Crawler" <appcrawler_8080 () hotmail com>]

Well,  we've decided that everything in our environment is pretty secure, 
except for our web applications. So, now we need to outsource the security 
assessment of our web applications. So, my question is, what should I be 
looking for? What should the auditors be looking for? How will I know that 
they are testing for what I need them to test for? What is a good price 
range, based on one e-commerce application, one employee intranet 
application, and one customer portal application? Should it be based on the 
number of forms? Or some other metric? Please advise?!?! Thanks.
_________________________________________________________________
Get ready for school! Find articles, homework help and more in the Back to 
School Guide! http://special.msn.com/network/04backtoschool.armx