Unless you have reproducible builds, having access to the source code can be deceiving. Audits should start with the actual binary. Only if you can ensure that

Unless you have reproducible builds, having access to the source code can be deceiving. Audits should start with the actual binary. Only if you can ensure that the binary was build from a specific source code and does not contain any other logic in there (i.e. it was build by a trusted compiler), you can happily skip the decompilation process and analyze that source instead.