Security audit framework of Internet Explorer Outlook Web Access (OWA) add-on?

What would a security (and privacy) auditor look for when reviewing an add-on for Outlook Web Access (OWA)? Does anyone have any advice on how to prepare for that?

Thanks! Swalsh