Checklists

We have rules for what makes the cut. If a checklist doesn't pass all four, it doesn't ship.

1. #01

   Each item is a distinct pattern.

   No 'review your security settings' generalities. Every item is one specific anti-pattern (e.g., 'DML inside loops') with a Signal you can grep for, a reason it tanks, and a Rebuild that fixes it.

2. #02

   Walks top to bottom in one sitting.

   Total run time is bounded (10 to 30 minutes). If a checklist needs three afternoons, it's actually a guide pretending to be a checklist.

3. #03

   Produces a findings list.

   Output of running a checklist is a list of items marked Found vs. N/A. The findings list is what gets prioritized into remediation work, not the checklist itself.

4. #04

   Built from production debugging.

   Every item came out of an actual production failure we debugged. We don't ship checklists that anticipate hypothetical issues; the bar is 'we've seen this break a real org at least three times.'

Checklists fail when readers treat them as inspiration. They work when readers treat them as a structured exercise with a deliverable.

Three patterns that compound

1. #01

   Open Salesforce Setup in one tab, the checklist in another.

   Don't read the checklist first and 'plan to run it later.' Open Setup, open the checklist, and walk top to bottom in the same sitting. Each item should take under 2 minutes to evaluate.

2. #02

   Mark each item Pass / Found / N/A as you go.

   Print the checklist or copy it into a doc. Marking is the forcing function that turns a read into an audit. Items left unmarked don't count.

3. #03

   Triage findings by blast radius before fixing anything.

   Don't try to fix all findings at once. Sort the Found column by blast radius (DML in loops on a high-volume object > hardcoded ID in a low-traffic Decision). Fix the top 3 first; queue the rest.

What not to do

• ✕Don't speed-read the checklist and skip the audit. The whole point is the structured walk-through; reading without auditing is the same as not reading.
• ✕Don't fix items as you find them. Audits are for finding; sprints are for fixing. Mixing the two means you'll spend an hour on the first item and never finish the audit.
• ✕Don't run a checklist quarterly when it should be monthly (or vice versa). Each checklist tells you the cadence; honor it.

Each new checklist comes from the third or fourth time we run the same audit by hand. The next batch covers the audits we run most often.

• Q3 2026

  Salesforce Permission Audit Checklist

  20-item audit of profile + permission set sprawl, with the 5 most common over-privileged patterns.

• Q3 2026

  Salesforce Data Quality Checklist

  12-item audit covering duplicate rate, fill rate, validation rule coverage, and silent ETL failures.

• Q4 2026

  Pre-Deploy Sandbox Checklist

  The 18-item walk-through every change should pass before promoting from sandbox to production.

• Q4 2026

  Quarterly Org Health Checklist

  30-minute audit covering license utilization, storage, integration health, and the top 10 Flow anti-patterns.

If a checklist you'd value isn't here, send it via the contact form. The third or fourth request for the same audit moves it to the front of the queue.