This is a good question.
If the NPC, which most of them are foes, or why would you really need to make stats for them anyways, is going to be sticking around for a long time, then I make a sheet for him. And then add levels as needed.
If on the other hand, the players are fighting something which is just another enemy, I use numbers based on the parties fighting ability. I guess, and roll so no one can see. If I throw a roll that would kill a player, I might say “well, your down” and leave it at that not telling them that they should have died. Also, I don’t answer questions like “what level it is,” or questions about its stats or equipment unless the player takes the time to try and figure out such things. And a spot check during most combat isn’t enough.
The stats don’t bother me much, the foe has what powers I wish him to have to an extent. I don’t load the enemy down with all the skills, weapons, items, or spells in which he’d be able to slay the party the quickest. That is, unless the foe is stalking them, hunting them or so on, then, the players better have been paying attention to the hints that I’ve been dropping. I make my foes, like real people, some times they are prepared, some times they aren’t and that’s just it.
Plus, after playing for a long time, a good DM should be able to just make a good guess about how powerful, or skilled a NPC should be. Ex: if the fighter in the group stumbled upon a sleeping troll, and the fighter is 7th level, then you might have to tone the troll down, or make it so that the fighter is fighting though lots of cover. The trolls more powerful, but he keeps taking out roots, and rocks and other things instead of he player, who is now in an “Indiana Jones” with the rock rolling after him, type scene. Or, I meant to send the player there, but when the troll wakes up, the player sees that its already wounded...and not hard to kill. Now the player has to wonder “what did this to it, and where is it? Is it still in the cave?” the player now runs back to the rest of the group and learns a lesson: just like in horror movies, in D&D no one should ever go off alone.
And instead of making certain foes powerful, I just throw in numbers. Say: the player started a fight with a town guard...instead of making it a fight based on their levels, Id keep the guard low level, but have him do the guard-thing “he’d call in other watchmen” now the player is higher level then all of them, but now there are three of them.
To me, the foes, and enemies and other things are setting, background, obsticles... their stories are what matter, not their stats.
I don’t have the time to make up stats for every orc, soldier, spirt, summoned creatures, wizard or w/e that my players my come across outside of my intended path for them.
Also, I don’t play with rules lawyers, so no one gets up set with the more free flowing, creative form of my game play. This isn’t to say that I don’t go by the rules, all foes, and challenges are set up correctly, but they aren’t always on paper, the aren’t up for player inspection...I’m the DM, and that’s all there is to it.
Game On.
