Atul Gawande’s The Checklist Manifesto: How to Get Things Right is a surgeon’s argument that the problem of modern expert work is not ignorance but ineptitude: we know what to do and fail to do it, because the volume and complexity of what we know has outrun any individual’s ability to apply it reliably under pressure. The remedy he proposes is embarrassingly simple and, as he shows from aviation, construction, intensive care and his own operating theatres, surprisingly hard to get right: a short list of the steps that matter most, checked at the moments when they are most likely to be missed. Published in 2009, after the World Health Organization surgical checklist he helped develop cut deaths in eight hospitals by nearly half, the book is the best account of why checklists work, why experts resist them and how to build one that will be used. For an internal auditor it is a book about control design in its purest form: what makes a procedure operate under pressure, what makes it decorative, and how to tell the difference. This guide summarises the book without reproducing it, sets out the cases and the design principles, maps them to audit practice, and ends with a worked example of a hospital system’s audit function auditing a checklist and building one of its own.
In this guide
- The book in one page
- Who Atul Gawande is, and how the book came about
- The structure: the cases
- The cases, and what each proves
- How to build a checklist that works: the design principles
- Why experts resist, and what overcomes it
- The nine ideas worth keeping
- The vocabulary: twelve terms defined for practitioners
- What it means for internal audit: the control that operates under pressure
- Simple, complicated and complex: where the checklist belongs
- The criticisms, and where checklists fail
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Ashgrove Health System audits a checklist and builds one
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is the problem? | In fields where knowledge has become vast, surgery, aviation, construction, finance, the failures are mostly failures to apply what is known: a step skipped, a check forgotten, a communication not made, under time pressure and in the belief that experts do not need reminding. |
| What is the proposal? | A checklist: not a comprehensive procedure but a short list of the critical steps most likely to be missed, read at defined pause points, with a discipline of actually stopping to check. |
| What is the evidence? | An intensive-care checklist at Johns Hopkins that cut central-line infections from 11 percent to near zero; its extension across Michigan hospitals, which saved an estimated 1,500 lives in eighteen months; the WHO surgical safety checklist, tested in eight hospitals in eight countries, which reduced major complications by about a third and deaths by nearly half. |
| Why do experts resist? | Because a checklist feels like an insult to competence and autonomy, and because badly built checklists, long, vague and imposed from above, have taught everyone that they are bureaucracy. |
| What makes one work? | Brevity, precision, the right pause points, language the users wrote, a format that forces communication across the team, and testing in the real setting before adoption. |
| Why read it as an auditor? | Because the function designs, tests and relies on procedures, and the book is the clearest statement available of what separates a procedure that operates from one that is merely documented; and because the function’s own work, under deadline, is as prone to skipped steps as anyone’s. |
| Reading time | About five hours for the paperback; it is short, direct and can be read in a sitting. |
Who Atul Gawande is, and how the book came about
Gawande is a surgeon at Brigham and Women’s Hospital in Boston (he paused his operating practice in 2022 to join USAID), a professor at Harvard, a longtime writer for the New Yorker and the author of several books on medicine and its failures. The World Health Organization asked him to lead a programme to reduce deaths in surgery worldwide, and the team’s answer, after studying how other high-stakes fields managed complexity, was a nineteen-item checklist read aloud at three points in every operation. The results of its pilot in eight hospitals, published in the New England Journal of Medicine in January 2009, were large enough to surprise the investigators, and the book, published by Metropolitan Books in December of that year, is the story of how the checklist came to be and what it revealed. Gawande went on to run a healthcare venture and, later, the United States Agency for International Development’s global health work, and the checklist has been adopted in thousands of hospitals.
The structure: the cases
| Chapter | What it covers | What it contributes |
|---|---|---|
| 1. The problem of extreme complexity | A case of a patient nearly lost to a missed step; the growth of medical knowledge beyond any individual’s grasp | The diagnosis: ineptitude, not ignorance |
| 2. The checklist | The 1935 crash of Boeing’s Model 299, the B-17 prototype, and the birth of the pilot’s checklist; Peter Pronovost’s central-line checklist at Johns Hopkins | The evidence that a simple list changes outcomes |
| 3. The end of the master builder | How skyscrapers are built: schedules, submittal checks and the forced communication among specialists | Checklists for complex, non-routine work |
| 4. The idea | What other fields had learned about complexity: the response to Hurricane Katrina and a restaurant kitchen | The design problem |
| 5. The first try | The WHO programme, the first surgical checklist and its failures in trial | Why most checklists fail |
| 6. The checklist factory | Boeing’s checklist designer and the craft of writing them | The design principles |
| 7. The test | The eight-hospital pilot and its results | The evidence |
| 8. The hero in the age of checklists | The Hudson River landing of 2009; investors who use checklists; why expertise and checklists are allies | The cultural argument |
| 9. The save | The author’s own error in theatre, a torn vena cava, survived because the checklist had the team prepared | The personal conclusion |
The cases, and what each proves
| Case | What happened | What it proves |
|---|---|---|
| The Boeing Model 299 crash (1935) | A new bomber crashed on a demonstration flight because an experienced pilot forgot to release a control lock; the aircraft was judged too complex to fly until pilots wrote a checklist, after which the type flew for decades | Complexity defeats memory even in experts; the checklist is the response, not more training |
| Central-line infections at Johns Hopkins (2001) | Pronovost listed the five steps for inserting a central line, had nurses observe whether doctors followed them, and empowered nurses to stop the procedure if a step was skipped; the ten-day infection rate fell from 11 percent to zero | A checklist with authority to enforce it changes behaviour; the steps were already known |
| The Michigan Keystone project (2003 to 2005) | The same approach across more than a hundred Michigan intensive-care units; infections fell by about two-thirds; an estimated 1,500 lives and $175 million saved in eighteen months | The result scales when the cultural conditions travel with the list |
| Skyscraper construction | Building a tower involves hundreds of specialists and thousands of decisions no one person can hold; the industry uses schedules of what must be checked and by whom, and a parallel schedule of who must talk to whom when problems arise | For complex, non-routine work the checklist forces communication rather than steps |
| The WHO surgical safety checklist (2008) | Nineteen items at three pause points, before anaesthesia, before incision and before the patient leaves; eight hospitals from Seattle to Tanzania; major complications down 36 percent, deaths down 47 percent | Even in well-resourced hospitals, a two-minute list changes outcomes |
| US Airways Flight 1549 (2009) | The landing on the Hudson after both engines failed; the first officer worked the engine-failure checklist while the captain flew the aircraft | Expertise and checklists together; the checklist freed the pilots’ attention for judgment |
| Investors | Fund managers who built checklists of errors from past failed investments and ran every decision through them | The method transfers to judgment-heavy, non-physical work |
How to build a checklist that works: the design principles
The chapter on Boeing’s checklist designer is the practical core of the book, and its principles are a specification an auditor can test any procedure against.
| Principle | What it means | The failure it prevents |
|---|---|---|
| Define the pause point | The checklist is run at a specific moment: before anaesthesia, before take-off, before the report is issued | A list with no trigger is never read |
| Choose DO-CONFIRM or READ-DO | In DO-CONFIRM the team works from memory and then pauses to confirm the items were done; in READ-DO the items are read and performed in order | Mismatch between the format and the work |
| Keep it short | Five to nine items per pause point; the killer items only | Long lists are skimmed, then abandoned |
| Killer items only | The steps that are most dangerous to skip and most likely to be skipped; not everything that matters | The important buried in the comprehensive |
| Precise, familiar language | Written by the people who use it, in their words, fitting on one page | Ambiguity, and the sense of imposition |
| Force communication | Items that require people to introduce themselves, state the plan, voice concerns | The quiet junior who saw the problem and said nothing |
| Test in the real world | Run it in the actual setting, revise, run again | The checklist that works in the conference room |
| Authority to stop | Someone other than the lead is empowered to halt the work if an item is missed | The list that is read and ignored |
The workpaper example guide and the workpaper best practices guide describe audit documentation; the principles above describe what would make a review checklist within that documentation operate rather than exist.
Why experts resist, and what overcomes it
The book’s most useful chapters for a change-minded auditor are the ones on resistance. Surgeons objected that the checklist was beneath them, that it slowed them down, and that their teams already communicated. What overcame the resistance was not argument but three things. First, the items were theirs: the lists that worked had been written and revised by the people who used them, in language they recognised. Second, the pause points were real: the checks were placed where the work already stopped, not added as a separate ritual. Third, the evidence was visible: when the infection rates and the complication counts fell in their own units, the sceptics became the advocates. The parallel to control implementation in any organisation is exact, and the getting recommendations adopted guide describes the same three conditions from the audit side. A control imposed by the second line in language the first line does not use, at a point the work does not naturally pause, without feedback on whether it is helping, will be resisted for the reasons the surgeons gave, and they were not entirely wrong.
The nine ideas worth keeping
- The failure is usually of application, not knowledge. An organisation that knows what to do and does not do it under pressure has a control design problem, not a training problem.
- Experts need checklists most. The more complex the work, the more a reminder of the critical steps matters; competence does not scale to memory.
- A checklist is not a procedure. It is the short list of what must not be missed, run at a defined moment; the comprehensive procedure lives elsewhere.
- Killer items. The design question is not what matters but what is most dangerous to skip and most likely to be skipped.
- Pause points are the mechanism. A check placed where the work naturally stops is run; one placed elsewhere is not.
- Communication items change outcomes too. The book argues that the surgical checklist’s introductions and briefings matter alongside its clinical checks; silence is a risk.
- Authority to stop is part of the design. A check that nobody can enforce is advice.
- Test it where it will be used. The first surgical checklist failed in trial; the second worked because the first had been tried.
- Discipline is not the enemy of judgment. The Hudson landing is the book’s proof that the checklist frees expertise for the decisions only expertise can make.
The ninth idea is the one the book was written to make, and it answers the objection that stops most checklists before they start. The pilots who landed on the Hudson in 2009 were praised as heroes, and the book’s point is that they were heroes who had worked the engine-failure checklist and kept to their procedures in the three and a half minutes available, and that the discipline of the lists was what allowed their judgment to be applied to the one decision no list could make, where to put the aircraft down. An audit function that resists its own checklists on the grounds that its people are experienced has misread the relationship: the checklist is not a substitute for the experience, it is the mechanism that protects the experience from the deadline.
The vocabulary: twelve terms defined for practitioners
| Term | What it means in the book | What it looks like in an audit |
|---|---|---|
| Checklist | A short list of critical steps checked at a pause point | A review step in an engagement, not the audit programme |
| Killer item | A step dangerous to skip and likely to be skipped | The control attribute whose omission has caused past findings |
| Pause point | A defined moment at which the list is run | Planning sign-off, fieldwork close, report issue |
| DO-CONFIRM | Work from memory, then confirm | The review of a completed workpaper |
| READ-DO | Read each item and perform it | A fieldwork procedure for an unfamiliar area |
| Communication check | An item that requires people to speak | The kickoff and closing meeting briefings; see the opening meeting guide |
| Authority to stop | The power to halt the work if an item is missed | The reviewer’s right to withhold sign-off |
| Ineptitude | Failing to apply known knowledge | The control that exists and did not operate |
| Complex problem | Unpredictable, non-routine, requiring judgment; contrasted with simple and complicated | Where checklists force communication rather than steps |
| Submittal schedule | Construction’s schedule of who must talk to whom, by when and about what | The engagement timeline with named reviewers |
| Forcing function | A design that makes the check unavoidable (our term rather than the book’s) | A workflow that will not advance without the item |
| Tick-box compliance | Running the list without the check | The failure mode the book warns against |
What it means for internal audit: the control that operates under pressure
The book applies to the function twice: to the controls it audits, many of which are checklists in substance, and to its own work, which is performed under deadline by experts who believe they do not need reminding. The management review controls guide and the review notes guide carry the surrounding method.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Auditing a checklist-based control (safety, clinical, operational, compliance) | Completion records prove the form was filled; observation proves the check was made | Observe the control at its pause point for a sample of instances; compare with the completion rate; interview the person with authority to stop |
| Evaluating control design in a complex process | A long procedure is not a control; the killer items and the pause points are | Ask the process owner which five steps must never be missed and where the work stops to check them; test those |
| Reviewing management review controls | A sign-off is a DO-CONFIRM check only if the reviewer confirms specific items | The precision test: what items does the reviewer check, and is there a list? |
| The function’s own engagements | Planning, fieldwork and reporting have pause points and killer items | A one-page engagement checklist at three pause points, written by the team; see the worked example |
| Workpaper review | Reviewers skim long files; a short list of what must be present changes what is checked | A review checklist of five to nine items, tested on real files before adoption |
| Implementing recommendations | Controls resisted for the surgeons’ reasons need the surgeons’ remedies | Recommendations written in the first line’s language, placed at natural pause points, with feedback on results; the adoption guide |
| Crisis and continuity | Checklists perform under stress where memory fails | Test whether the continuity and incident plans have checklists, and whether they have been run; the resilience guide |
| Communication in teams | Introductions and briefings prevent the silent omission | The opening and closing meeting agendas as communication checks |
Simple, complicated and complex: where the checklist belongs
The chapter on construction introduces a distinction the book borrows from two Canadian researchers and that an auditor should keep: problems are simple, like baking a cake, where a recipe works every time once learned; complicated, like sending a rocket to the moon, where many parts and specialists must be coordinated but the coordination can be planned and repeated; or complex, like raising a child, where each case is different, outcomes are uncertain and expertise is necessary but not sufficient. The B-17 and the central line are simple problems in this sense: the steps are known, the failure is forgetting. A skyscraper is complicated, and the construction industry’s answer is a schedule of checks and a schedule of communication. Surgery, the book argues, is all three at once, and the surgical checklist is designed accordingly: task items for the simple steps, communication items for the complex ones, and the pause points to make both happen.
The distinction matters for control design because the audit profession’s instinct is to treat every process as simple and to prescribe steps, which produces long procedures that are followed in form and fail in substance when the case is complex. The Normal Accidents summary describes the systems in which no list of steps can prevent the interaction that causes the failure, and the book’s answer for that territory is the communication check: the item that makes the people who can see the problem say so. An auditor evaluating a control over a complex process should ask whether the control makes anyone speak, not only whether it makes anyone sign. Among the surgical checklist’s items, the book puts particular weight on the ones in which the team introduced themselves by name and role and the surgeon stated what might go wrong, which cost nothing, took a minute and changed what the junior nurse was willing to say forty minutes later.
The criticisms, and where checklists fail
The book has been criticised on evidence and on scope. On evidence, later studies of surgical checklists in other settings, including a large Canadian rollout, found smaller or no effects, and the explanation offered was the one the book itself gives: a checklist imposed without the cultural conditions, the ownership, the pause points, the authority to stop, becomes tick-box compliance and changes nothing. The finding supports the design argument while undermining the claim that the list alone is the cause. On scope, critics note that checklists suit work with identifiable critical steps and defined moments, and that much professional work, including most judgment in auditing, is not of that kind; the book’s own chapter on complex problems concedes this and shifts the checklist’s role to forcing communication. The fair conclusion for an auditor is that the book describes a control that works in specific conditions, that the conditions are the design principles, and that a checklist found in an organisation should be audited for the conditions rather than for its existence.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Hardback | Metropolitan Books, December 2009, about 210 pages | The first edition |
| Paperback | Picador, 2011 | The edition most readers own |
| Audiobook | Available as a digital audiobook | An easy listen; the design chapter is worth re-reading on the page |
| Reading plan | Chapters 2, 3, 6 and 7 | An auditor with one evening |
| The checklist itself | The WHO surgical safety checklist is freely available and fits on one page | The model to compare any organisational checklist against |
| Companion reading | The Normal Accidents summary for the systems where checklists are not enough; the Phoenix Project summary for automation as the next step | Placing the argument |
A one-hour discussion guide for an audit team
- Ten minutes: the killer items. Each person writes the five things most dangerous to miss in an engagement and most often missed. Compare the lists; the overlap is the checklist.
- Ten minutes: the pause points. Agree the three moments in an engagement at which the work naturally stops and a check could be run.
- Fifteen minutes: the control we audit. Pick a checklist-based control in the organisation and discuss how the function has tested it: completion records or observation? Decide which the next test will use.
- Fifteen minutes: the resistance. Recall a recommendation that was resisted and ask which of the surgeons’ three objections applied, and which of the three remedies was missing.
- Ten minutes: the draft. Write the function’s one-page engagement checklist, in the team’s own words, and agree to test it on the next three engagements before adopting it.
Worked example: Ashgrove Health System audits a checklist and builds one
Ashgrove Health System is a fictional non-profit of five hospitals with $2.1 billion in revenue and an internal audit function of twelve. Two things happened in 2027. The function audited the system’s surgical safety checklist compliance, which management reported at 98 percent; and the director, who had read the book, used it to build a checklist for the function’s own engagements.
| Activity | What the function did | What it found or produced |
|---|---|---|
| Surgical checklist: completion versus observation | Observed forty operations across three hospitals at the three pause points, against the electronic completion records | Completion records showed 98 percent; observation showed the pre-incision pause fully performed in 61 percent, with the introductions and the anticipated-events briefing most often skipped; one hospital at 88 percent, one at 40 |
| Surgical checklist: authority to stop | Interviewed circulating nurses on whether they had ever halted an operation for a missed item | At the 40 percent hospital, none had and two said they would not; at the 88 percent hospital, a surgeon had publicly backed a nurse who did |
| Report | Finding on observed performance at two hospitals; the completion metric replaced by a sampled observation metric in the quality dashboard | The chief medical officer adopted the observation metric; the 40 percent hospital’s rate reached 85 percent in two quarters after its surgical chief ran the briefings himself |
| The function’s own checklist: killer items | Each auditor listed the five most dangerous omissions; the overlap produced seven | Risk assessment reviewed by someone other than the author; sample size documented before testing; every exception discussed with the owner before the report; finding rated with a stated loss and probability; report read aloud for tone; the audit committee chair briefed before issue on any high finding; the issue entered in the tracker with an owner and a date |
| The function’s own checklist: pause points | Planning sign-off, fieldwork close, report issue | Two to three items at each; DO-CONFIRM format; one page |
| The function’s own checklist: test | Run on three engagements and revised twice | On the second engagement the fieldwork-close check caught a sample size that had been set after testing began; on the third, a high finding that had not been discussed with the owner |
The surgical finding was uncomfortable, because the completion metric had been reported to the board for years and the observation metric was lower, and the director recorded the book’s argument in the report: a checklist is a check only when it is run, and the record of its completion is a record of a form. The function’s own checklist caught two of its own omissions in its first month, which the director reported to the audit committee with some satisfaction as the first time the function had audited itself with a tool rather than a resolution. The committee asked whether the pre-issue check could include one more item, one that the book’s argument points to: has anyone on the team got a concern they have not voiced? It was added.
Frequently asked questions
Is the evidence for surgical checklists still good?
The original eight-hospital study showed large effects; later rollouts showed smaller ones where the cultural conditions were missing. The consensus is that the checklist works when it is owned, run at real pause points and backed by authority to stop, which is the book’s own argument.
What is the difference between a checklist and an audit programme?
The programme is the comprehensive set of procedures; the checklist is the short list of what must not be missed, run at a defined moment. The function needs both, and the book is about the second.
How should an auditor test a checklist-based control?
By observation at the pause point, compared with completion records, and by interviewing the person with authority to stop. Completion records alone test the form.
Can checklists apply to judgment-heavy work like auditing?
Yes, for the killer items and the communication points; not for the judgment itself. The investors in chapter eight used checklists of past errors to structure decisions, which is the model for an engagement checklist.
Why do good controls get resisted?
For the surgeons’ reasons: imposed language, artificial pause points and no visible result. The getting recommendations adopted guide covers the remedies from the audit side.
Where does the book sit in the reading list?
In the operations and control design group of the internal audit reading list, as the companion to Normal Accidents: one is about the discipline that works in linear work, the other about the systems where it is not enough.
Related guides
- Management Review Controls: Documenting Precision — the sign-off that is a DO-CONFIRM check
- Audit Review Notes Done Right — the review checklist within the file
- Getting Audit Recommendations Adopted — the surgeons’ objections and remedies
- The Audit Opening Meeting: Agenda, Script and Follow-Up — communication checks at the start
- Normal Accidents: Summary and Lessons for Auditors — where the checklist is not enough
- The Phoenix Project: Summary and What It Means for IT Auditors — automation as the next step
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- The Field Guide to Understanding ‘Human Error’ by Sidney Dekker: Summary for Auditors — incident investigation beyond blame
- Black Box Thinking by Matthew Syed: Summary and Lessons for Auditors — learning from failure, as aviation does.
Leave a Reply