Get a technical person to scope it out (Score 1)

As someone that used to lead teams that did this kind of work, too little attention was paid to the thoroughness of the testing by both client and testers. "What is supposed to be tested", "what was tested" and "what were the results" were simple questions that I would ask but testers and client were only interested in "what vulnerabilities were found". I could have 100 interesting findings but have only tested 1 out of 10 components that were supposed to be tested - and that was fine! You should make a list of what you want tested and demand that you be told what was tested and what were the results of those tests.