A code-level government audit of all life-critical software sounds impractical. There are already millions of lines of code in production on FDA approved devices (e.g. pacemakers?) so I am sure that standards and certification processes around this already exist.