As embedded software is now a critical component of medical devices (e.g., insulin pumps and pacemakers), I have found that quality assurance processes extend beyond just functionality to encompass patient safety and regulatory compliance. Looking specifically at IEC 62304 (targeted for software lifecycle processes) and ISO 14971 (for risk management), strict testing and documented traceability requirements are laid out. 

Personally, three QA processes really stood out to me. 1) Traceability & Verification requirement: standards set that all software components have to be mapped to design, implementation, and testing, building networks of clear evidence trails linking safety and performance. 2) Risk-Based Testing: FDA expectations and standards have clearly delineated a greater emphasis on sources of potential harm to patients. For example, if there is a bug in a user-interface color scheme that still needs to be revised, however, that will be weighted less than an error of drug dosage calculations. 3) Formal Code Reviews & Static Analysis: Before testing even begins, automated tools are leveraged to tease apart memory leaks/race conditions to detect hidden issues. Thus, this reduces the risk of costly failures during clinical trials/post-market use. 

Additionally, I found the requirement for mandated documentation of software functionality in a repeatable and auditable manner also quite interesting, as this demands the thorough documentation of rigor in this context. 

Given this background, what is typically the hardest QA process for dev teams? Is it traceability, risk-based testing, or rigorous code reviews?