# Using the Checklist Well

A checklist is a memory aid, not a script. The best audits follow the work and use the checklist to make sure
nothing is missed.

## Process approach (turtle diagram)

```
            With what (equipment, software)        With whom (people, competence)
                              \                      /
  Inputs (from whom) ---> [ PROCESS: owner, purpose ] ---> Outputs (to whom)
                              /                      \
            How (procedures, criteria)             Measures (KPIs, targets, trends)
```
Start at the process owner: purpose, KPIs, risks. Then go to where the work happens and follow one job through.

## Audit trails

Pick a real item and follow it: one customer order from quote to delivery; one NCR from detection to effectiveness
check; one supplier from selection to latest scorecard. Trails test the links between processes, which is where
systems fail.

## Sampling

| Population | Sample |
|------------|--------|
| 1-10 records | 2-3 |
| 11-50 | 3-5 |
| 51-200 | 5-8 |
| > 200 | 8-12, stratified (shifts, product lines, months) |

Choose the sample yourself (not the auditee); include recent, old and unusual items (rush orders, rework, night
shift). ISO 19011 Annex A.6 describes judgement-based and statistical sampling.

## Questioning

| Do | Avoid |
|----|-------|
| Open questions: "show me", "how do you", "what happens if" | Closed questions: "do you have a procedure?" |
| Ask the person who does the work | Letting the supervisor answer for operators |
| Silence after a question | Suggesting the answer |
| Verify claims with records or observation | Accepting "we always do that" |
| Record exact evidence: document ID, revision, record date, role | Vague notes ("training OK") |

## Recording results

| Result | When | Write |
|--------|------|-------|
| C (conforms) | Evidence seen and adequate | What was sampled ("NCR-2611, 2614, 2620 reviewed") |
| NC | Requirement not met, with evidence | Requirement + evidence + statement (see the finding writer) |
| OFI | Requirement met but a risk or weakness | The risk and the observation |

## Before and after

- **Before:** read the previous audit report, open CAPAs, KPIs, recent complaints and changes for the process;
  tailor the checklist (add questions on recent problems, drop irrelevant ones).
- **After:** close with the auditee: findings, evidence, agreement on facts. Write the report within a few days.