Often, developers with a particular interest or skill in security perform auditing.
Organizations have an audit organization focused on other regulatory compliance, and these people will perform security review.