The Checklist Manifesto: How to Get Things Right

by Atul Gawande

Failures of ignorance we can forgive. If the knowledge of the best thing to do in a given situation does not exist, we are happy to have people simply make their best effort. But if the knowledge exists and is not applied correctly, it is difficult not to be infuriated. What do you mean half of heart attack patients don’t get their treatment on time? What do you mean that two-thirds of death penalty cases are overturned because of errors? It is not for nothing that the philosophers gave these failures so unmerciful a name—ineptitude.

that know-how is often unmanageable. Avoidable failures are common and persistent, not to mention demoralizing and frustrating, across many fields—from medicine to finance, business to government. And the reason is increasingly evident: the volume and complexity of what we know has exceeded our individual ability to deliver its benefits correctly, safely, or reliably. Knowledge has both saved us and burdened us.

think we have been fooled about what we can expect from medicine—fooled, one could say, by penicillin.

Medicine didn’t turn out this way, though. After a century of incredible discovery, most diseases have proved to be far more particular and difficult to treat. This is true even for the infections doctors once treated with penicillin: not all bacterial strains were susceptible and those that were soon developed resistance. Infections today require highly individualized treatment, sometimes with multiple therapies, based on a given strain’s pattern of anti-biotic susceptibility, the condition of the patient, and which organ systems are affected.

The ninth edition of the World Health Organization’s international classification of diseases has grown to distinguish more than thirteen thousand different diseases, syndromes, and types of injury—more than thirteen thousand different ways, in other words, that the body can fail. And, for nearly all of them, science has given us things we can do to help. If we cannot cure the disease, then we can usually reduce the harm and misery it causes. But for each condition the steps are different and they are almost never simple. Clinicians now have at their disposal some six thousand drugs and four thousand medical and surgical procedures, each with different requirements, risks, and considerations. It is a lot to get right.

Over the course of a year of office practice—which, by definition, excludes the patients seen in the hospital—physicians each evaluated an average of 250 different primary diseases and conditions. Their patients had more than nine hundred other active medical problems that had to be taken into account.

The damage that the human body can survive these days is as awesome as it is horrible: crushing, burning, bombing, a burst aorta, a ruptured colon, a massive heart attack, rampaging infection. These maladies were once uniformly fatal. Now survival is commonplace, and a substantial part of the credit goes to the abilities intensive care units have developed to take artificial control of failing bodies. Typically, this requires a panoply of technology—a mechanical ventilator and perhaps a tracheostomy tube if the lungs have failed, an aortic balloon pump if the heart has given out, a dialysis machine if the kidneys don’t work. If you are unconscious and can’t eat, silicone tubing can be surgically inserted into your stomach or intestines for formula feeding. If your intestines are too damaged, solutions of amino acids, fatty acids, and glucose can be infused directly into your bloodstream.

This is the reality of intensive care: at any point, we are as apt to harm as we are to heal. Line infections are so common that they are considered a routine complication. ICUs put five million lines into patients each year, and national statistics show that after ten days 4 percent of those lines become infected. Line infections occur in eighty thousand people a year in the United States and are fatal between 5 and 28 percent of the time, depending on how sick one is at the start.

There is complexity upon complexity. And even specialization has begun to seem inadequate. So what do you do? The medical profession’s answer has been to go from specialization to superspecialization. I told DeFilippo’s ICU story, for instance, as if I were the one tending to him hour by hour. That, however, was actually an intensivist (as intensive care specialists like to be called). As a general surgeon, I like to think I can handle most clinical situations. But, as the intricacies involved in intensive care have grown, responsibility has increasingly shifted to superspecialists. In the past decade, training programs focusing on critical care have opened in most major American and European cities, and half of American ICUs now rely on superspecialists.

Yet given how much surgery is now done—Americans today undergo an average of seven operations in their lifetime, with surgeons performing more than fifty million operations annually—the amount of harm remains substantial. We continue to have upwards of 150,000 deaths following surgery every year—more than three times the number of road traffic fatalities. Moreover, research has consistently showed that at least half our deaths and major complications are avoidable. The knowledge exists. But however supremely specialized and trained we may have become, steps are still missed. Mistakes are still made.

What they decided not to do was almost as interesting as what they actually did. They did not require Model 299 pilots to undergo longer training. It was hard to imagine having more experience and expertise than Major Hill, who had been the air corps’ chief of flight testing. Instead, they came up with an ingeniously simple approach: they created a pilot’s checklist. Its mere existence indicated how far aeronautics had advanced. In the early years of flight, getting an aircraft into the air might have been nerve-racking but it was hardly complex. Using a checklist for takeoff would no more have occurred to a pilot than to a driver backing a car out of the garage. But flying this new plane was too complicated to be left to the memory of any one person, however expert.

They check that the brakes are released, that the instruments are set, that the door and windows are closed, that the elevator controls are unlocked—dumb stuff. You wouldn’t think it would make that much difference. But with the checklist in hand, the pilots went on to fly the Model 299 a total of 1.8 million miles without one accident.

What, for instance, are the vital signs that every hospital records if not a kind of checklist? Comprised of four physiological data points—body temperature, pulse, blood pressure, and respiratory rate—they give health professionals a basic picture of how sick a person is. Missing one of these measures can be dangerous, we’ve learned.

In a complex environment, experts are up against two main difficulties. The first is the fallibility of human memory and attention, especially when it comes to mundane, routine matters that are easily overlooked under the strain of more pressing events. (When you’ve got a patient throwing up and an upset family member asking you what’s going on, it can be easy to forget that you have not checked her pulse.) Faulty memory and distraction are a particular danger in what engineers call all-or-none processes: whether running to the store to buy ingredients for a cake, preparing an airplane for takeoff, or evaluating a sick person in the hospital, if you miss just one key thing, you might as well not have made the effort at all. A further difficulty, just as insidious, is that people can lull themselves into skipping steps even when they remember them. In complex processes, after all, certain steps don’t always matter. Perhaps the elevator controls on airplanes are usually unlocked and a check is pointless most of the time.

Checklists seem to provide protection against such failures. They remind us of the minimum necessary steps and make them explicit. They not only offer the possibility of verification but also instill a kind of discipline of higher performance. Which

These checklists accomplished what checklists elsewhere have done, Pronovost observed. They helped with memory recall and clearly set out the minimum necessary steps in a process. He was surprised to discover how often even experienced personnel failed to grasp the importance of certain precautions. In a survey of ICU staff taken before introducing the ventilator checklists, he found that half hadn’t realized that evidence strongly supported giving ventilated patients antacid medication. Checklists, he found, established a higher standard of baseline performance. These

Complex problems are ones like raising a child. Once you learn how to send a rocket to the moon, you can repeat the process with other rockets and perfect it. One rocket is like another rocket. But not so with raising a child, the professors point out. Every child is unique. Although raising one child may provide experience, it does not guarantee success with the next child. Expertise is valuable but most certainly not sufficient. Indeed, the next child may require an entirely different approach from the previous one. And this brings up another feature of complex problems: their outcomes remain highly uncertain.

people are individual in ways that rockets are not—they are complex. No two pneumonia patients are identical. Even with the same bacteria, the same cough and shortness of breath, the same low oxygen levels, the same antibiotic, one patient might get better and the other might not.

“A building is like a body,” he said. It has a skin. It has a skeleton. It has a vascular system—the plumbing. It has a breathing system—the ventilation. It has a nervous system—the wiring. All together, he explained, projects today involve some sixteen different trades. He pulled out the construction plans for a four-hundred-foot-tall skyscraper he was currently building and flipped to the table of contents to show me. Each trade had contributed its own separate section. There were sections for conveying systems (elevators and escalators), mechanical systems (heating, ventilation, plumbing, air conditioning, fire protection), masonry, concrete structures, metal structures, electrical systems, doors and windows, thermal and moisture systems (including waterproofing and insulation), rough and finish carpentry, site work (including excavation, waste and storm water collection, and walkways)—everything right down to the carpeting, painting, landscaping, and rodent control.

But I didn’t really get his explanation until he brought me to the main conference room. There, on the walls around a big white oval table, hung sheets of butcher-block-size printouts of what were, to my surprise, checklists.

He posted a new printout showing the next phase of work each week, sometimes more frequently if things were moving along. The construction schedule was essentially one long checklist. Since every building is a new creature with its own particularities, every building checklist is new, too. It is drawn up by a group of people representing each of the sixteen trades, including, in this case, someone from Salvia’s firm making sure the structural engineering steps were incorporated as they should be. Then the whole checklist is sent to the subcontractors and other independent experts so they can double-check that everything is correct, that nothing has been missed. What results is remarkable: a succession of day-by-day checks that guide how the building is constructed and ensure that the knowledge of hundreds, perhaps thousands, is put to use in the right place at the right time in the right way.

Pinned to the left-hand wall opposite the construction schedule was another butcher-block-size sheet almost identical in form, except this one, O’Sullivan said, was called a “submittal schedule.” It was also a checklist, but it didn’t specify construction tasks; it specified communication tasks. For the way the project managers dealt with the unexpected and the uncertain was by making sure the experts spoke to one another—on X date regarding Y process. The experts could make their individual judgments, but they had to do so as part of a team that took one another’s concerns into account, discussed unplanned developments, and agreed on the way forward. While no one could anticipate all the problems, they could foresee where and when they might occur. The checklist therefore detailed who had to talk to whom, by which date, and about what aspect of construction—who had to share (or “submit”) particular kinds of information before the next steps could proceed. The submittal schedule specified, for instance, that by the end of the month the contractors, installers, and elevator engineers had to review the condition of the elevator cars traveling up to the tenth floor. The elevator cars were factory constructed and tested. They were installed by experts. But it was not assumed that they would work perfectly. Quite the opposite. The assumption was that anything could go wrong, anything could get missed.

In the face of the unknown—the always nagging uncertainty about whether, under complex circumstances, things will really be okay—the builders trusted in the power of communication. They didn’t believe in the wisdom of the single individual, of even an experienced engineer. They believed in the wisdom of the group, the wisdom of making sure that multiple pairs of eyes were on a problem and then letting the watchers decide what to do.

He showed me an application called Clash Detective that ferreted out every instance in which the different specs conflicted with one another or with building regulations. “If a structural beam is going where a lighting fixture is supposed to hang, the Clash Detective turns that beam a different color on-screen,”

There’s yet another program, called ProjectCenter, that allows anyone who has found a problem—even a frontline worker—to e-mail all the relevant parties, track progress, and make sure a check is added to the schedule to confirm that everyone has talked and resolved the matter.

The philosophy is that you push the power of decision making out to the periphery and away from the center. You give people the room to adapt, based on their experience and expertise. All you ask is that they talk to one another and take responsibility. That is what works.

The trouble wasn’t a lack of sympathy among top officials. It was a lack of understanding that, in the face of an extraordinarily complex problem, power needed to be pushed out of the center as far as possible. Everyone was waiting for the cavalry, but a centrally run, government-controlled solution was not going to be possible.

No, the real lesson is that under conditions of true complexity—where the knowledge required exceeds that of any individual and unpredictability reigns—efforts to dictate every step from the center will fail. People need room to act and adapt. Yet they cannot succeed as isolated individuals, either—that is anarchy. Instead, they require a seemingly contradictory mix of freedom and expectation—expectation to coordinate, for example, and also to measure progress toward common goals.

They had made the reliable management of complexity a routine. That routine requires balancing a number of virtues: freedom and discipline, craft and protocol, specialized ability and group collaboration. And for checklists to help achieve that balance, they have to take two almost opposing forms. They supply a set of checks to ensure the stupid but critical stuff is not overlooked, and they supply another set of checks to ensure people talk and coordinate and accept responsibility while nonetheless being left the power to manage the nuances and unpredictabilities the best they know how.

the no-brown-M&M’s clause. “When I would walk backstage, if I saw a brown M&M in that bowl,” he wrote, “well, we’d line-check the entire production. Guaranteed you’re going to arrive at a technical error.… Guaranteed you’d run into a problem.” These weren’t trifles, the radio story pointed out. The mistakes could be life-threatening.

People celebrate the technique and creativity of cooking. Chefs are personalities today, and their daring culinary exploits are what make the television cooking shows so popular. But as I saw at Rialto, it’s discipline—uncelebrated and untelevised—that keeps the kitchen clicking. And sure enough, checklists were at the center of that discipline. First there was the recipe—the most basic checklist of all. Every dish had one. The recipes were typed out, put in clear plastic sleeves, and placed at each station. Adams was religious about her staff’s using them. Even for her, she said, “following the recipe is essential to making food of consistent quality over time.” Tacked to a bulletin board beside the dessert station was what Adams called her Kitchen Notes—e-mails to the staff of her brief observations about the food. The most recent was from 12:50 the previous night. “Fritters—more herbs, more garlic … more punch,” it said. “Corn silk in corn! Creamed corn side on oval plates—not square! Mushrooms—more shallots, garlic, and marsala. USE THE RECIPES!”

The recipes themselves were not necessarily static. All the ones I saw had scribbled modifications in the margins—many of them improvements provided by staff. Sometimes there would be a wholesale revamp. One new dish they were serving was a split whole lobster in a cognac and fish broth reduction with littleneck clams and chorizo. The dish is Adams’s take on a famous Julia Child recipe. Before putting a dish on the menu, however, she always has the kitchen staff make a few test runs, and some problems emerged. Her recipe called for splitting a lobster and then sautéing it in olive oil. But the results proved too variable. Too often the lobster meat was either overcooked or undercooked.

Even here, in one of our most particularized and craft-driven enterprises—in a way, Adams’s cooking is more art than science—checklists were required. Everywhere I looked, the evidence seemed to point to the same conclusion.

By 2004, surgeons were performing some 230 million major operations annually—one for every twenty-five human beings on the planet—and the numbers have likely continued to increase since then. The volume of surgery had grown so swiftly that, without anyone’s quite realizing, it has come to exceed global totals for childbirth—only with a death rate ten to one hundred times higher.

Worldwide, at least seven million people a year are left disabled and at least one million dead—a level of harm that approaches that of malaria, tuberculosis, and other traditional public health concerns.

Finding a way that could reach every operating room in the world seemed absurd. With more than twenty-five hundred different surgical procedures, ranging from brain biopsies to toe amputations, pacemaker insertions to spleen extractions, appendectomies to kidney transplants, you don’t even know where to start.

As a result, the most risky part of surgery—anesthesia—is done by untrained people far more often than the surgery itself.

The secret, he pointed out to me, was that the soap was more than soap. It was a behavior-change delivery vehicle. The researchers hadn’t just handed out Safeguard, after all. They also gave out instructions—on leaflets and in person—explaining the six situations in which people should use it. This was essential to the difference they made.

At the start of the study, the average number of bars of soap households used was not zero. It was two bars per week. In other words, they already had soap. So what did the study really change? Well, two things, Luby told me. First, “We removed the economic restraint on purchasing soap. People say soap is cheap and most households have soap. But we wanted people to wash a lot. And people are quite poor. So we removed that as a barrier.” Second, and just as important, the project managed to make soap use more systematic.

Surgery has, essentially, four big killers wherever it is done in the world: infection, bleeding, unsafe anesthesia, and what can only be called the unexpected. For the first three, science and experience have given us some straightforward and valuable preventive measures we think we consistently follow but don’t. These misses are simple failures—perfect for a classic checklist. And as a result, all the researchers’ checklists included precisely specified steps to catch them. But the fourth killer—the unexpected—is an entirely different kind of failure, one that stems from the fundamentally complex risks entailed by opening up a person’s body and trying to tinker with it.

the more familiar and widely dangerous issue is a kind of silent disengagement, the consequence of specialized technicians sticking narrowly to their domains. “That’s not my problem” is possibly the worst thing people can think, whether they are starting an operation, taxiing an airplane full of passengers down a runway, or building a thousand-foot-tall skyscraper. But in medicine, we see it all the time. I’ve seen it in my own operating room.

But the evidence suggests we need them to see their job not just as performing their isolated set of tasks well but also as helping the group get the best possible results. This requires finding a way to ensure that the group lets nothing fall between the cracks and also adapts as a team to whatever problems might arise.

So was another step that these checklists employed, one that was quite unusual in my experience: surgical staff members were expected to stop and make sure that everyone knew one another’s names.

There have been psychology studies in various fields backing up what should have been self-evident—people who don’t know one another’s names don’t work together nearly as well as those who do.

As great as the construction-world checklists seemed to be, they were employed in projects that routinely take months to complete. In surgery, minutes matter. The problem of time seemed a serious limitation. But aviation had this challenge, too, and somehow pilots’ checklists met it.

Bad checklists are vague and imprecise. They are too long; they are hard to use; they are impractical. They are made by desk jockeys with no awareness of the situations in which they are to be deployed. They treat the people using the tools as dumb and try to spell out every single step. They turn people’s brains off rather than turn them on. Good checklists, on the other hand, are precise. They are efficient, to the point, and easy to use even in the most difficult situations. They do not try to spell out everything—a checklist cannot fly a plane. Instead, they provide reminders of only the most critical and important steps—the ones that even the highly skilled professionals using them could miss. Good checklists are, above all, practical.

You must decide whether you want a DO-CONFIRM checklist or a READ-DO checklist. With a DO-CONFIRM checklist, he said, team members perform their jobs from memory and experience, often separately. But then they stop. They pause to run the checklist and confirm that everything that was supposed to be done was done. With a READ-DO checklist, on the other hand, people carry out the tasks as they check them off—it’s more like a recipe.

you want to keep the list short by focusing on what he called “the killer items”—the steps that are most dangerous to skip and sometimes overlooked nonetheless.

a checklist has to be tested in the real world, which is inevitably more complicated than expected. First drafts always fall apart, he said, and one needs to study how, make changes, and keep testing until the checklist works consistently.

On average, the study reported, it took doctors seventeen years to adopt the new treatments for at least half of American patients. What experts like Dan Boorman have recognized is that the reason for the delay is not usually laziness or unwillingness. The reason is more often that the necessary knowledge has not been translated into a simple, usable, and systematic form.