The Checklist Manifesto in an outline
by Andreas Tissen · · updated
Say you release your app every week. One afternoon, with a call about to start, you skip running the migration on staging because it has never failed, and this time production breaks. You knew the step; you skipped it.
Atul Gawande wrote a whole book about that kind of failure and about the plain checklist that catches it. Below are what his study measured, the rules he took from aviation, and a version of the checklist in Pando, the outliner I built, where the master list stays clean and every run is a dated copy.
What the surgeons found
Gawande is a surgeon and writer, and his book The Checklist Manifesto (2009) grew out of a World Health Organization project. The study behind it, published in the New England Journal of Medicine in January 2009, introduced a 19-item surgical safety checklist in eight hospitals in eight countries. Among 7,688 patients, complications fell from about 11 per cent to 7 per cent, and inpatient deaths from 1.5 to 0.8 per cent.
The steps on that checklist were things every team in the room already knew, such as confirming the patient's identity and the site of the operation. In the introduction Gawande writes that "the volume and complexity of what we know has exceeded our individual ability to deliver its benefits correctly, safely, or reliably", and the checklist is his answer to that gap between knowing a step and doing it.
Rules from the cockpit
For the practical rules Gawande went to Daniel Boorman, who wrote checklists for Boeing. Boorman's first rule is a pause point: "You must define a clear pause point at which the checklist is supposed to be used." For a release that moment is "before you press deploy"; for a month's books it is "before you send the report".
The list should be short. Gawande gives a rule of thumb that some use, to keep it "between five and nine items, which is the limit of working memory", and to choose the steps that hurt most when skipped. He also describes two kinds: read-do, where you do each step as you read it, and do-confirm, where you work from memory and then stop to check.
The list also has to change. The teams in the book tested and rewrote their lists, dropping lines nobody needed and adding a line when a failure got through that no line would have caught.
Why most checklists get used up
Most checklist tools make you tick the list itself. Once it is ticked, it is used up: for the next run you either untick everything and lose the record of the last one, or you start from a list that arrives half ticked.
Revision suffers too. If editing the list is awkward, it stops matching the work, and you end up ticking a line for a step you stopped doing months ago.
Masters above, runs below
A checklist in Pando has two parts: a master, which you never tick, and runs, which are dated copies that you do tick. In the picture the master is a release checklist whose pause point, before you ship, is in its name. The run for release 1.4.0 on 11 June has three lines ticked, and Announce in the changelog is still open.
At the pause point you duplicate the master, give the copy the date in its name, and tick the copy. The master stays clean. Every run starts complete, and the pile of dated runs shows when a line started getting skipped. Changing a line in the master takes a second, because it is an ordinary bullet. The Verify DNS line could come from a book: if you keep reading notes with your own sentence on top, an idea from the notes can be mirrored straight into the list.
The checklist template has a Masters branch with two examples (a release list whose pause point is before you ship, and a read-do weekly close) and a Runs branch for the dated copies. Its page shows the tree read-only. Show in my Pando puts a copy at the top of your Home once you are signed in.
Once it is yours, rename the masters to your own pause points.
Claude makes the run
A connected Claude can read and write your checklist branch. At the pause point you tell it "release run". It makes the dated copy of the master under Runs.
It can also read the runs for you. If you note on a run when something went wrong, Claude can list which lines were left open in those runs, and which lines have been ticked in every run so far. Deciding what belongs on the list stays with you, along with what you learn when something fails.
Pando is free up to 5,000 bullets with every feature, agents included, and Pro costs 3 EUR a month. To run your next release from a clean master, create a free account and connect Claude.