Worth noting that this is a rough description of how IEC 62304 looks at the problem, but adherence to that standard is not required by many regulatory bodies (i

Worth noting that this is a rough description of how IEC 62304 looks at the problem, but adherence to that standard is not required by many regulatory bodies (including FDA, although there is guidance). It's a good approach to this, but there are others. More generally, the regulatory body will be looking for you to have a formal engineering process in place and be able to demonstrate its efficacy. Part of that will be looking for how you do hazard and risk analysis, how you handle CAPA (corrective and preventative actions in FDA-speak), how you do system trace, design history file generation, etc. etc. That you have a software development plan and can demonstrate how you follow it. So they aren't really interested in code reviews per se, but they are very interested in how you view code reviews, how you perform them when you do, what gets documented, how you perform trace an V&V etc.