After the incident, the arithmetic
A retainer client calls on a Saturday night with a suspected compromise. Three of your responders work on it over the weekend and into the next week: triage, log review, containment advice, a call with the client's insurer, and a report. Everyone is focused on the incident. Nobody is thinking about the retainer.
A fortnight later, finance asks how much of the client's retainer was used. The responders' time is in three places: one logged it in the PSA, one kept notes in a document, one did not record the weekend at all. The retainer contract says out-of-hours time counts at a higher rate, some preparation work does not count, and unused hours roll over for part of the year. Working it out takes a day and produces a figure nobody is fully confident in.
The client, meanwhile, assumes most of their retainer is still there.
Some retainers also include proactive hours: a tabletop exercise, a readiness review, a playbook update. Those get used, or forgotten, on a different timetable again.
Why retainer hours are hard to track
- Incident work is urgent, and recording time is the last thing on anyone's mind.
- Several responders work on one incident, often at unusual hours.
- Each retainer has its own rules: what counts, out-of-hours rates, rollover, expiry, overage rates.
- Retainer hours can also be used for proactive work, which is tracked differently.
- The client cannot see their balance without asking.
What loose tracking costs
| Gap | Consequence |
|---|---|
| Time not recorded during incidents | Hours delivered but never counted |
| Retainer rules applied by hand | Inconsistent, disputed balances |
| Overage not flagged | Unbilled work, or a surprise invoice |
| Proactive hours unused | Client feels the retainer was poor value |
| No client view | Renewal conversation starts from confusion |
Insurers and legal advisers add another layer. Some incidents involve a client's insurer or their lawyers, whose own rules on who is engaged and who pays may differ from the retainer. If that is not recorded against the incident at the start, sorting out which hours belong where afterwards is slow and contentious.
The retainer tracking we build
- Each retainer is recorded with its rules: hours, period, what counts, out-of-hours multipliers, rollover and expiry, overage rate.
- When an incident or proactive task is opened for a retainer client, it is linked to their retainer in your PSA or ticketing system.
- Responders log time with the least effort possible: a quick entry from their phone, or a start and stop on the incident, with time of day recorded so the right rate applies.
- At the end of an incident, the lead responder gets a prompt to check everyone's time is in before the incident is closed.
- The balance per retainer is calculated under its rules and shown to your team, with a warning as it approaches its limit or its expiry.
- Clients can see their own balance and history in a simple portal or monthly statement, including unused proactive hours they could still use.
What your team and clients see
Finance has a correct balance per retainer without a day of reconstruction. Incident leads know when a client is heading into overage, and can tell the client during the incident rather than on an invoice afterwards. Account leads can see which clients have unused hours and suggest a tabletop exercise or a readiness review before they expire.
At renewal, both sides have the same history, which is a far better starting point than competing recollections of a busy weekend.
Picture the Saturday night call again with this in place. The incident is opened against the client's retainer with one click. Each responder starts and stops time on their phone as they go. On Tuesday, the lead sees the retainer is close to its limit and mentions it on the client call. When the incident closes, the lead confirms everyone's time is in, and the client's statement updates the same day.
Signs you need retainer tracking
- Retainer balances are worked out by hand after incidents.
- Responders' time during incidents is recorded inconsistently.
- Clients do not know their remaining hours.
- Overage is discovered after the event.
- Proactive retainer hours expire unused.