In theory it should be possible to conduct such audits ("assessments" probably fits better) in a scientific and thorough manner, so that the process and its res

In theory it should be possible to conduct such audits ("assessments" probably fits better) in a scientific and thorough manner, so that the process and its result are replicable. I assume that in most cases software security assessments are not done in this way probably resulting in the finding of some bugs but no true assurance statements of the code itself. If somebody here can give some references on the state of the art of software security assessments I would be very thankful for that.