A checklist item stating that “document control is in place” might appear to make sense, yet it provides the auditor with minimal information to audit against. What constitutes being in place? Which document is under consideration? What proof indicates that control exists? Auditing this requirement with two auditors on the same process could lead to two different audit findings based upon the vagueness of the requirement.
Do not start by looking at a checklist. Instead, take the standard clause and identify the action being performed, what it is being performed on, any conditions associated with the action, and who is performing the action. The standard might state “controlled documents shall be reviewed and approved for adequacy prior to issue.” The key components are documents, review, approval, and prior to issue. Maintaining these key components will ensure the checklist item does not become less or more stringent than the standard.
Translate the clause into an observable requirement. “Are controlled documents reviewed and approved prior to issue?” is much better than “Is document control effective?” The auditor can now inspect the document, approval signature, effective date, and/or revision history. The checklist item does not dictate how the approval should be obtained, but rather if the outcome is verifiable.
Ideally, a checklist item consists of a focused question and an evidence pointer. The focused question asks if each sampled procedure has been approved prior to the effective date, and the evidence pointer lists approval records, document status, and/or revision history. The evidence pointer aids in achieving consistency across the audit, but should not introduce an additional requirement. If multiple types of evidence are allowed by the standard, do not single out only one type of evidence as acceptable.
Attempt to convert one standard requirement using this approach. Place the standard requirement at the top of a page. Underline the verb that represents the action being taken, circle the noun that represents the object of the action, and place brackets around any conditions or time constraints associated with the action. Now write one checklist question. Ask another person how they would verify the checklist question. When they provide an answer that is different from your intended answer, revise the wording without creating additional requirements. This exercise will reveal vague words such as appropriate, adequate, periodically, and properly.
Document the traceability of the standard requirement. Place the standard clause beside the checklist item, and include the related procedure, responsible party, and relevant record where applicable. When the standard or internal procedure is updated, it will be easier to revise the checklist item. A well-constructed checklist item does not have to read like legal language, but rather allows auditors to audit the same requirement, know where to find relevant evidence, and apply consistent criteria.