If you read my previous posting, you have an understanding of goal oriented pentesting. That being said, let’s assume for a second that the goal of a penetration assessment is to get access to sensitive information and that it is possible to achieve this goal in several different ways. Now the penetration testing team should be able to achieve this goal, but can they find all possible vectors? Not necessarily.
Without a testing methodology the team will likely reach a point of diminishing returns in which their efforts are not producing unique attack vectors for achieving the goal(s). The only way to ensure complete coverage of an application, is to use a testing methodology like the Full OWASP Testing Methodology.
The Full OWASP Testing Methodology is useful because it provides a comprehensive guide for techniques that can be used to identify risks within a web application by testing each component. Each component is tested in several different ways. Testing each component ensures that the application is tested fully. All penetration assessments should use both a goal oriented approach as well as a strong testing methodology. This will ensure that the assessment covers both depth and breadth.