Planned work and unplanned work: the two halves of an IT week
Nearly everything an IT team does lands in one of two piles, and the piles behave nothing alike.
Planned
Project work
It has a scope, an owner and a date. Somebody decided to do it.
- Migrations and upgrades: mail, servers, operating systems
- Rollouts: new laptops, new starters, a new office
- Scheduled patching and maintenance windows
- Network, backup and security improvements
- Documentation and runbooks
Unplanned
Support work
It arrives when it arrives. Nobody scheduled it, and someone has to drop what they were doing.
- Help desk requests, from a password reset to “my screen is blank”
- Incidents and outages
- Security alerts and reported phishing
- Full disks, failed jobs, expired certificates
- Access requests that were needed yesterday
Unplanned work cannot be scheduled, but it can be measured. That is what IT time tracking is for. Measured, it explains much of what goes wrong with the planned kind: the migration estimated at three weeks that takes six, because the same people were also answering the phone.
Some work straddles the line. Routine maintenance is planned but never finishes, and a critical patch is scheduled but urgent. Do not agonise over it. Decide once which side each belongs to, write it down and stay consistent. A steady split beats a perfect one.
Why ticket counts hide the hours
A ticketing tool tells you how many. It rarely tells you how long. A two-minute password reset and a server rebuild that eats an afternoon are one ticket each, and a chart of ticket volume treats them as equal jobs.
Plenty of IT work never becomes a ticket at all: the question at your desk, the walk to the print room, the meeting about the migration. That work is real, and no dashboard shows it.
Ticket time tracking sits next to the ticket system, not in place of it. Leave the tickets where they are. Start the timer when you pick a ticket up, put its number in the note and stop when you put it down.
How the two connect: there is no integration with ticketing tools today, so the ticket number in the note is the link. Reports does not search notes, but the Excel export carries every one of them, so any ticket is one search away in the spreadsheet.
Set up an IT support time tracker
An IT support time tracker is the same product with different names on the buttons. Whoever administers your organization creates the task types once, and everyone picks from them in the timer. Here is a set that fits most IT teams, with the side of the planned/unplanned line each one usually falls on.
| Task type | What goes in it | Usually |
|---|---|---|
| Help Desk | Requests from people: accounts, passwords, software, “it is not working”. | Unplanned |
| Incident | Outages and degraded services: diagnosing, fixing and following up. | Unplanned |
| Security | Alerts, phishing reports, access reviews and hardening. | Either |
| Maintenance | Patching, backup checks, renewals and general housekeeping. | Planned |
| Infrastructure | Servers, network, cloud and storage: builds, changes and upgrades. | Planned |
| Deployment | Rolling out software and hardware, from a new release to a new starter’s laptop. | Planned |
Six task types are enough to start, and the names are yours to change. Add Meetings and Documentation if they take a real share of your week. If you also look after other companies, a Client Support task type keeps their requests apart from your own. Keep the whole list to eight or fewer, or people stop choosing carefully. The clicks, and where a ticket number goes, are in how to track time spent on tasks.
Keep planned and unplanned work apart
Time Tracker Software HQ has no “planned” switch, and it does not need one. Task types say what kind of work an entry was. Projects say what it was for. Use both and the split comes out of your project list.
Planned
One project per initiative
Name each after the outcome and close it when it is done.
- Microsoft 365 Migration
- Office Wi-Fi Refresh
- Laptop Rollout, Q4
Attach Infrastructure, Deployment, Meetings and Documentation.
Unplanned
Standing projects that never close
They run all year and collect whatever comes in.
- Service Desk, with Help Desk
- Incidents, with Incident and Security
- Routine Maintenance, with Maintenance
Each one offers only the task types you attach.
That last point does the heavy lifting. A project only offers the task types attached to it, so someone working under Service Desk cannot log Infrastructure by accident, and a migration project never collects password resets. The split is made when the timer starts, not patched up on Friday.
To read it back, open Reports, choose September’s dates and the Incidents project, and the total at the bottom is what incidents cost you that month. Repeat for Service Desk and for each planned project; each is one filter. For everything in one place, export the month to Excel and sort by project.
A Wednesday with an outage in it
The desktop timer holds one entry at a time: pick the project and the task type, add a note, press Start. Those fields lock while it runs. So an interruption is not a pause. One entry ends and another begins, and the log ends up honest about it. This is what a bad day looks like.
- Morning checks Project Routine Maintenance, task type Maintenance, note “Backup job review, patch status.” Stop at 09:20.
- The planned work Project Office Wi-Fi Refresh, task type Infrastructure, note “Controller config, floor 3.” Start.
- The VPN goes down Stop the Wi-Fi entry. Project Incidents, task type Incident, note “INC-2041 VPN down, Lisbon office.” A few clicks, and the outage is on the record before you open the first log file.
- Service restored Stop. The outage cost 1h 15m, and it is filed under Incidents rather than buried inside the Wi-Fi project. Start a fresh Infrastructure entry to carry on where you left off.
- A run of small requests Project Service Desk, task type Help Desk, note “Password resets, a dead docking station.” A few minutes each is not worth a timer apiece, so they share one entry.
- Patch restart Your laptop reboots to finish an update with the timer still running. Next time you open the desktop app it shows “Unfinished timer found”: the project, task type, start time and a duration measured to the last recorded activity, with Save and Discard. It does not guess for you.
Not a monitoring tool. IT teams install plenty of software that watches other people’s machines. This is not that. An entry holds the project, task type, note, start, stop and the platform that recorded it. There is no screen capture and no keystroke logging.
What the log can answer
A month of entries turns arguments about workload into arithmetic. These are the questions IT leads tend to ask first, and the filter that answers each.
- What did the outage cost us?
- Filter by the Incidents project and the dates around it. The total at the bottom is the hours spent, before counting anything anyone lost while waiting.
- How much of the month went on support, and how much on projects?
- Read the totals for Service Desk, Incidents and Routine Maintenance, then for each planned project, or sort the Excel export by project.
- Did the migration take as long as we said?
- Filter by the migration project for its total against your estimate, then by task type to see what it was made of: Infrastructure, Meetings or Documentation.
- Which kind of work keeps coming back?
- Compare Help Desk hours from month to month. When password resets grow every quarter, the hours are your case for self-service, or for one more pair of hands.
- Who is carrying the support load?
- Filter Service Desk by person. If one name keeps coming up, the fix is rota design, not a pep talk.
What each person sees depends on their role. Admins see the whole organization, team leads see the entries of the teams they lead, and everyone else sees their own. Correcting an entry is a permission too, and every change is written to the activity log.
MSP time tracking: if you support other companies
Managed service providers (MSPs) and IT consultants run the same two kinds of work for several customers at once. The setup stretches to fit:
- A standing project per support contract, such as “Northwind Traders – Managed Support,” and a project per engagement, such as “Northwind Traders – Server Migration.” The log then reads like your customer list.
- Client Support as a task type, so a customer’s request is never mistaken for your own team’s help desk.
- On-site visits. The desktop timer keeps counting without a connection and uploads what it queued when one returns.
Time Tracker Software HQ records the hours. It has no rates and no invoices, so export a customer’s month to Excel and use it wherever you prepare your own billing.
Common mistakes
- One task type called “Support.” Everything goes into it and you learn nothing. At the least, keep Help Desk apart from Incident.
- Tracking only the projects. The week then looks like all planned work, and the interruptions you set out to prove stay invisible.
- A timer for every five-minute request. Nobody keeps that up. Batch the small stuff into one Help Desk entry, and time separately anything you would mention at stand-up.
- Stopping when the post-mortem ends. Stop the incident entry when the service is back. The write-up is Documentation.
- Copying your ticket categories. Thirty ticket categories do not need thirty task types. Six to eight, and let the ticket number carry the detail.
- Putting sensitive detail in the note. Notes are read in the log and the export. Write the ticket number, not the password, the link or the user’s personal problem.
- Never reading it back. Put the split between planned and unplanned hours on the agenda of your monthly review. A log nobody opens is only overhead.
Frequently asked questions
No. It does help desk time tracking, not ticketing: it records the hours. Keep your tickets in the tool you already use and put the ticket number in the note of the time entry, so the two can be matched later.
Create one project for each planned initiative, such as a migration or a rollout, and a few standing projects for the rest, such as Service Desk, Incidents and Routine Maintenance. Task types then say what kind of work each entry was. A project only offers the task types attached to it, so the split is made when the timer starts, not corrected afterwards.
The timer runs one entry at a time. Stop the current entry, start one for the interruption with the project and task type that fit, stop it when you are done, and start the original work again. Very small requests can share a single Help Desk entry instead of getting a timer each.
The next time the desktop app opens it shows an "Unfinished timer found" prompt with the project, task type, start time and duration, measured up to the last recorded activity. You choose Save or Discard. Nothing is saved or thrown away without your say-so.
There is no integration with ticketing tools today. Put the ticket number in the note when you start the timer. The notes travel with the Excel export, so a ticket number is one search away in the spreadsheet.
Yes. Start the timer when the page comes in and stop it when the service is back. The entry keeps its real start and stop times, so an evening or weekend fix sits in the log like any other.
No. An entry holds the project, the task type, an optional note, the start and stop times and the platform that recorded it. Time Tracker Software HQ does not capture screens, keystrokes or what was open on the computer.
Yes. Filter Reports by dates, person, project or task type and export that view to Excel. Each row has the project, task type, person, start, end, duration and note, with a total row at the end.
It is free during early access, for every seat, and no credit card is needed to start. If that changes you will hear about it well in advance.