While code auditor play role on that job, i think what your client actually need is expert on digital forensic/forensic analysis which have experience on cryptocurrency field. And since many mixer/coinjoin technique rely on amount of user to improve it's privacy, audit result could be less useful when your client have lots of costumer.