Audits are good and definitely have a place. There’s much more that can be done. I agree open source is also an important one.
We’ve tried to identify strong signals of trustworthiness together with a few other services here: https://mullvad.net/blog/2018/10/17/signals-trustworthy-vpns...
A technical solution Mullvad is working on is something we call System Transparency. You can read more about that here: https://mullvad.net/blog/2019/6/3/system-transparency-future...