Kyslan / Library

Revenue leakage

Where MSP revenue leaks, ranked by how much it costs

Updated 27 August 2026 · 13 min read · By Kyslan, a Northbeams product

Kyslan finds the unbilled work in your own PSA, then writes the change order that bills it. First report free, read-only. Claim it back →

What revenue leakage actually is

Revenue leakage is the gap between the work you delivered and the money you invoiced for it. It is not bad debt, which is money invoiced and not paid. It is not discounting, which is money you decided not to charge. It is money you earned, were entitled to, and never asked for.

That distinction matters because leakage is the only one of the three that costs you nothing to fix. Bad debt needs a collections process. Discounting needs a sales conversation. Leakage needs a query.

Why it survives good people

No MSP loses this money through carelessness. It survives because of three structural facts that are true in every shop:

1. The record of the work and the record of the contract live in different places. The ticket knows what happened. The agreement knows what was sold. Nothing checks them against each other automatically.
2. The decision to bill is made at the worst possible moment. At ticket close, by a tired engineer, on a screen where the safe-looking option is the one that does not generate an awkward call.
3. Nobody owns the gap. The service desk owns delivery. Accounts owns invoicing. The space between them, where a closed ticket should have become a line on an invoice, belongs to no one.

Add to that the fact that any single instance is small. Forty minutes here, one seat there. Nobody escalates a forty minute problem. Eleven of them, running every week for a year, is a salary.

The eleven leaks, ranked

Ranked by the size of the annual hole they typically open in a mid-sized MSP, largest first.

1. Seat and device drift

Users get onboarded through a ticket. Devices get an RMM agent through a deployment script. Neither event touches the agreement, so the contracted count and the real count separate immediately and never re-converge. This is the biggest leak in most shops because it compounds: a seat missed in month one is missed in all eleven remaining months, and again next year.

Find it: active directory or tenant user count against invoiced seats, per client, per month. Any client where the two differ by more than one is a finding.

2. Billable time closed as non-billable

The single most common individual error. The engineer solved the problem, wrote a good note, and left the billing flag on the default. Or set it to non-billable because the client had been grumbling about invoices, which is a commercial decision being made by someone with no commercial authority.

Find it: non-billable hours by engineer and by ticket type, over 90 days. Outliers are not a discipline problem, they are usually a configuration problem: one ticket type or one board defaulting the wrong way.

3. Prepaid blocks that ran out

Hours keep being drawn against a block with a zero or negative balance. The work is real, the client is real, the entitlement is gone. This one is dangerous because it is discovered late, and a nine month old bill is a bill you will end up discounting.

Find it: every block balance, every week. Anything under 20% remaining, and anything negative, goes to the account owner by name.

4. Out of scope work absorbed into the contract

Someone asks for a thing that is not in the agreement. It takes ninety minutes. It gets done, logged against the managed services agreement, and disappears. Repeat across every client every week.

Find it: hours per client per month, trended over twelve months, against contract value. A client whose hours rose 30% while their invoice stayed flat is telling you something.

5. Projects delivered and never invoiced at completion

Fixed-price projects that finished, went live, and never triggered the final invoice because the milestone lived in a project plan rather than in the billing system. Big individual amounts, low frequency.

Find it: every project with a completed status and no invoice raised in the following 30 days.

6. Annual uplifts never applied

The contract says the fee rises with an index or by a stated percentage each year. Applying it is a manual step. Manual steps in a busy quarter do not happen. Two years of a missed 4% uplift is 8% of that contract, forever, because the base never caught up.

Find it: list every agreement with an uplift clause and the date it was last increased. Anything more than 13 months is a finding.

7. Out of hours work billed at standard rate

The premium rate exists in the price book and is applied by a human remembering to apply it. Time entries carry a timestamp, so this is fully mechanical and almost never mechanised.

Find it: time entries outside contracted hours billed at the standard rate.

8. Onboarding and offboarding done for free

Most contracts include support for existing users and price the setup of a new one separately. In practice a starter is onboarded through a normal ticket, and the setup fee is never raised.

Find it: new user tickets against onboarding fees invoiced, per client, per quarter.

9. Hardware and licence pass-through at the wrong margin

Licences bought at one price and resold at last year's price, or at cost because the markup was applied manually. Microsoft licence counts in particular drift monthly and are rarely re-read.

Find it: licence counts from the vendor portal against licence counts invoiced, monthly.

10. Tickets closed with zero time logged

The work happened. The time entry did not. Zero-time tickets are not evidence of efficiency, they are evidence of a missing record, and a missing record cannot be billed even when the entitlement exists.

Find it: closed tickets with no time entry, by engineer, over 90 days.

11. Contract end dates that passed

An agreement expired and the service continued. Sometimes the invoice continues too, which is a legal exposure. Sometimes it stops, which is a revenue one. Either way nobody decided.

Find it: every agreement with an end date in the past 90 days or the next 90 days.

Working out your own number

The 5 to 15% range is an industry figure, and industry figures are for deciding whether to look, not for putting in a forecast. Your own number comes from one calculation:

Most owners guess low before they run it. The reason is that leakage is invisible by construction: the evidence of the loss is a record that does not exist.

Finding it in your PSA

Every leak above is a query, and all of them are available in the three PSAs most MSPs run. The obstacles are practical rather than technical:

• The queries live across agreements, tickets, time entries, invoices and projects, so each one is a join, not a report you can click.
• They need to run on a schedule. A leak found once is a one-off recovery. A leak found weekly is a fixed process.
• Somebody has to read the output and act, which is why an audit that produces a spreadsheet produces nothing.

Guides for each platform: ConnectWise Manage agreements, HaloPSA contracts, and Autotask PSA contracts. If you would rather not build the queries, Kyslan runs all of them read-only and returns the findings itemised with the evidence attached.

Recovering it without a fight

Finding the money is the easy half. Asking for it is where MSPs lose their nerve, usually because they approach it as an apology. Four rules that work:

1. Lead with the evidence, not the amount. "Here are eleven tickets from March and April, with the time entries" lands very differently from "you owe us $4,200".
2. Recover forward where the past is awkward. For anything older than a quarter, correcting the contract from next month is usually worth more than winning an argument about last year, and it costs no goodwill.
3. Separate the correction from the relationship. Seat drift is an administrative fix. Framing it as a billing dispute makes it one.
4. Fix the cause in the same conversation. Clients accept a correction far more readily when it comes with the change that stops it recurring.

Stopping it coming back

A one-off recovery is a bonus. A closed leak is an asset. Five changes do most of the work:

• Reconcile before the invoice run, not after. Seats, devices and block balances checked monthly, in that order.
• Make the billable flag a required field with no default, so it is a decision rather than an omission.
• Give every leak an owner by name. Not a team. A person, with the report landing in their inbox on a schedule.
• Put uplifts and contract end dates in a calendar that raises a ticket, not in the contract PDF where nobody reads them.
• Measure the gap as a number you report monthly. Anything not measured returns to 5 to 15% within a year.

The pattern behind all five: leakage is not fixed by trying harder. It is fixed by moving the decision from a person under pressure to a rule that runs on a schedule.

Common questions

Keep reading