Buying the Time: The Protected Prevention Hour

Wednesday, 10:05, at Bellweather Logistics. Noor's calendar has a block in it from ten to eleven that says "prevention hour". On her second screen is the candidates list with line two circled. That line concerns the scanner cradles at the north depot, whose firmware drops the connection about thirty times a month. The queue holds thirty-eight tickets. Petra is on queue duty and has been since eight. At 10:05 Noor's phone rings, and it is the north depot manager, who has her direct number, about a scanner. The scanner is in the queue already; Petra will get to it; nothing about it is urgent. Noor looks at the block in her calendar and then at the phone. What she does next is the subject of this article. So is the fact that it should not be her decision.

The prevention hour is a fixed, recurring block of time per technician, reserved for removing the causes of tickets. It is protected by a written agreement that says what may interrupt it and what may not. It is the answer to the time-budget question the first article in this series insisted on. The hours for prevention come from here, by name, every week, and the queue is told so in advance. This article is part of our From Reactive to Proactive Support series. This article is about buying the time, because nothing in the other five articles happens without it.

It covers why an hour and why protected, and pairing the hour with queue duty so that someone is always holding the queue. Then come what "protected" means in practice, down to the three things that may break it, and the manager whose job is the defence. Next come the first three months, in which there is nothing visible to show and the queue is slightly slower. The article then covers the honest conversation with leadership and Bellweather's hour quarter by quarter, as a worked example. It ends with a short war story and the prevention-hour agreement to copy, in that order.

Why an Hour, and Why Protected

An hour a week per technician is the smallest slice that gets anything removed and the largest slice a small desk can take from its queue without anyone outside the desk noticing. For a desk of five it is five hours a week, roughly a thirtieth of the desk's time. That is small enough that the service-level figures move by less than their normal wobble. It is also enough: the cheap candidates in the previous article cost two to five hours each. So one technician finishes one in a month, and a desk of five removes three or four causes a quarter. That is the arithmetic. Bigger slices come later, when the first causes have paid for them. Then the hour can grow to ninety minutes or two without a new argument, because by then the argument has numbers.

Protected means written down, with the exceptions listed, and agreed by the person who will be asked why the queue is up. An unprotected hour is the annual plan in a calendar instead of a drawer, and it lasts about as long. The queue will claim it in the first fortnight, not through anyone's bad intent. Every individual ticket is a reasonable reason to take ten minutes, and ten reasonable minutes six times is the hour. The agreement at the end of this article is short. Its most important line is the one that says who may cancel the hour, because the answer is "almost nobody, and never the technician alone".

The hour is per technician rather than one shared block, for two reasons. The first is ownership: a candidate with a name on it gets finished, and a candidate owned by "the desk's Wednesday hour" gets discussed. The second is coverage: five separate hours on five different days mean the queue is never short more than one person. A single five-person block would empty the desk for an hour a week. In my experience, it would be cancelled by the second week for exactly that reason. One person, one hour, one line on the list. The hour is small on purpose. Its size is what makes it survivable.

Pairing It With Queue Duty

The prevention hour only works inside a rotation where someone is always holding the queue. That rotation is the subject of sustainable pacing in the burnout series. It is a queue-duty roster in which each technician has days on the queue, taking everything that arrives. They also have days off it, doing project and prevention work with the interruptions going to someone else. The hour lives on an off-queue day. It is never scheduled for the person on duty, because the person on duty is, by definition, the one who gets interrupted. An hour that is scheduled to be interrupted is not protected by anything but hope.

The pairing is what answers the depot manager's phone call. Noor is not on duty on Wednesday; Petra is. The scanner ticket is Petra's to work, in order, and the hour is Noor's. The agreement says so, and the roster says so. The depot manager will be told so, politely, with the ticket number, by Noor, in one sentence, before she goes back to the firmware. If the roster did not exist, the call would be an argument between Noor's hour and Noor's conscience. Conscience wins those every time. That is how desks end up with technicians who have never once taken an hour they were given. Where ownership is by claim, as in QuerySolv, the roster is visible in the queue itself. In that setup, the person on duty is the one whose name is appearing on the new tickets. Anyone who looks can see that the off-duty technician is not ignoring anything.

Bellweather's week makes the pairing concrete. There are five technicians and five days, with one on queue duty each day and a second as backup during the morning peak. Each technician's prevention hour is placed on a day when they are neither duty nor backup. The table is the roster as it stood in the first quarter. The roster itself, with breaks and the end-of-day rule, is built in the sustainable pacing article and is not rebuilt here. What matters for this article is the column on the right: nobody's hour is on a day they hold the queue.

Ines, who leads the desk, has an hour too, and takes a queue shift too, and both of those are deliberate. A lead who is exempt from the queue stops knowing what the queue feels like. A lead who is exempt from prevention cannot defend it with a straight face. Her hour goes on the audit, the candidates list and the loop, which is prevention's own administration. Her hour is on the roster where everyone can see it being taken or not.

What "Protected" Means in Practice

Protected means that exactly three things may interrupt the hour, and everything else waits sixty minutes. The first is a major incident, declared as such by whoever the major incident series says declares it, which at a small desk is usually the lead. A declared incident calls everyone and the hour is moved without discussion. The second is two or more technicians out at once, which leaves the queue with no backup and the hour's owner as the only cover. The third is a ticket at the highest priority, meaning the kind that stops a site or a process rather than a person, with no one else free to claim it. Those are the three. A depot manager's phone call is not one of them. Neither is a queue of thirty-eight, nor a senior person's printer, nor a technician's own feeling that they really should.

An interrupted hour is moved, never cancelled, and the move happens before the hour's owner leaves their desk. "Moved to Thursday at two" takes five seconds to write and means the hour still exists. "We'll find time later" means it does not, and later is where the annual plan lives. A moved hour that has not been taken by the end of the week is reported at the monthly loop as a lost hour, with the reason. The reasons are read in a list. Three lost hours in a month with "queue was busy" beside them is a protection failure. The manager's job, below, is to notice that pattern before the technicians decide the agreement was decorative.

The technician's side of the agreement is that the hour is spent on the list, and ends with a note. Before the hour starts, the owner knows which line on the candidates list they are working, and the hour's first minute is not spent choosing. When the hour ends, two or three sentences go into the candidate's own record: what was done, what was found, what is next. If you run QuerySolv, each hour's note can go on the candidate's own ticket as an internal note. Then the event history becomes the ledger without a second document. The note is what makes the first three months survivable, because it is the only evidence, for a while, that anything is happening.

Two misuses of the hour deserve naming because they are so easy. The first is spending it on the queue, "just to clear a few quick ones first". That is the queue claiming the hour with the technician's consent, and the quick ones are never few. The second is spending it on something interesting that is not on the list: a tool to evaluate, a script to tidy, a thing the technician has wanted to do for months. Interesting is fine; the list is where interesting goes to be counted, and if it earns a line it earns the hour. (The script was going to be very good. The script is always going to be very good.)

The Manager Who Defends It

The hour has one defender, and it is the manager, because every other party has a reason to take it. The queue takes it because the queue is infinite. The requester takes it because the requester is waiting. The technician takes it because the technician feels the requester waiting. The manager's own boss takes it, indirectly, by asking why the queue is up this month. A manager without a prepared answer will quietly let the hour go rather than have that conversation twice. The defence is a job, with sentences in it, and the sentences are known in advance.

The manager says, to the technician who wants to skip the hour: "the queue is Petra's today; take the hour." To the depot manager who rang Noor directly: "the ticket is in the queue with a number, and Petra has it." To their own boss, when the response time ticks up: "we took five hours a week out of the queue in January to remove the causes of about a third of it, and the first cause is coming out this month; here is the ledger." To the team, at the loop: "three hours were lost this month, here are the reasons, and two of them should not have happened." None of these is a speech. They are each one sentence, and the manager who has them ready is the one whose desk still has an hour in the spring.

The manager also reports the hour, monthly, in the same breath as the queue numbers. That makes the hour a thing leadership hears about as normal rather than a thing that surfaces only when it is in trouble. "Prevention: five hours a week; this month the scanner cradle firmware was applied at the north depot and the connection-drop tickets fell from about thirty to four" is a line in the monthly report. Once that line has appeared three times nobody asks what the hour is for. The last article in this series is about that line. Here the point is that it is the manager's line to write, and writing it is part of the defence.

Finally, the manager defends the hour by taking a queue shift themselves, as Ines does on Friday afternoons. A manager who holds the queue for half a day a week knows exactly what the technicians are being asked to walk away from. The technicians know the manager knows. The case for the manager's queue shift is made in the sustainable pacing article for reasons of load. It holds here for reasons of credibility, which are the same reasons wearing a different coat.

The First Three Months, With Nothing to Show

The first three months of the hour produce almost nothing a dashboard can see. The agreement says so in advance so that nobody is surprised. Month one is the audit and the candidates list: five hours a week spent reading tickets and tallying causes, which removes nothing and looks, from outside, like five technicians doing admin. Month two is the first cheap candidate, which at Bellweather was the scanner firmware, applied at the north depot in the third week. So the ticket count for that cause had one week in month two to fall. Month three is the first count that moved, and it is one count, for one cause, at one depot. Meanwhile the queue has been five hours a week slower than it was, which on a desk of five is a small, visible, real amount. Someone will mention it.

Set the expectation in writing before the first hour, because an expectation set afterwards is an excuse. The agreement's "what to expect" section says nothing is removed in month one. The first cause is removed in month two or three, and the first count moves by the end of the quarter. Response time is slightly up for the quarter. Break-even on hours comes around the end of the second quarter, and the hour grows from the third. Those are Bellweather's numbers and a different desk will write different ones. But a desk that writes none has promised whatever the reader imagined, and the reader imagines a dashboard going green in a month.

The hour's ledger is what fills the gap. Every hour ends with a note. The notes, read together at the loop, are the evidence that the hours were spent on prevention and not absorbed. "Week three: read sixty lockout tickets; twenty-six are the tablet mail application; fix identified" is a line that shows progress with no count moved. Twelve such lines in a quarter are a story a manager can tell upward. The story is the difference between "nothing to show" and "nothing done", which are the same from a distance and the opposite up close. A programme with a ledger survives its first quarter. A programme with only a ticket count usually does not.

The Honest Conversation With Leadership

The conversation with leadership is a time-investment case. Its shape is hours taken, hours returned, when, and how it will be measured. That shape is built in the training and time case in the justifying-resources series. This article adds only the prevention-specific version of its lines. Hours taken: five a week, from the queue, starting on a date. Hours expected back: the audit's preventable pile, at Bellweather about ninety technician hours a month, of which perhaps a third can be removed in the first year by the hour alone. When: nothing in the first quarter, break-even inside two, net return from the third. How measured: the ticket count by cause, before and after, with the counting rules in the last article of this series. That is the whole case, and it fits on half a page.

Say what the queue will do while the hour is being spent, because leadership will ask. The honest answer is that it will be slightly slower for a quarter. It will not be noticeably slower to most requesters, and it will be within the service-level targets if the targets were set realistically. But it will be slower. A report that pretends otherwise will be found out by the first person who looks at the response-time chart. "Response time will rise by a small amount for a quarter and then fall below where it was, because the tickets that are removed are the ones that were filling the queue" is a sentence that survives the chart. Promising no effect is the fastest way to lose the hour at the first review.

Expect the pushback, and answer it from the data rather than the heart. "Can't you do this in quiet time?" There is no quiet time; the audit's time-budget line shows the queue taking every hour it is not forbidden from taking. "Other teams manage without it." Other teams have a queue that stays the same size every year; this one is being asked to shrink. "We will revisit next year." Next year's queue will contain this year's preventable tickets, twelve more times each, and the ledger will show what they cost. The calm versions of these answers, with the data each one leans on, are in anticipating the pushback. They apply to the hour exactly as they apply to a headcount.

Bellweather's Hour, Quarter by Quarter

Bellweather's desk of five supported about 450 staff across an office and six depots. Its hour began in the first week of a quarter, with five hours a week, which over thirteen weeks is about sixty-five technician hours. The first quarter spent twenty of those on the audit and the list. It spent thirty on the scanner firmware and the printer standard at the two southern depots. The rest went on hours that were moved, taken late, or lost. Four were lost, all in one bad week in week nine, with "both backups out" beside them, which is one of the three permitted reasons. By the end of the quarter the scanner connection drops had gone from about thirty a month to four, at half an hour each. That is roughly thirteen hours a month returned. The southern depots' odd-model printer tickets had started to fall. The quarter cost sixty-five hours and returned, by its last month, about thirteen a month. The queue's median response time was up by about a tenth. Nobody outside the desk mentioned it.

The second quarter removed the depot starter's shared-mailbox step, which had been about twenty tickets a month. It finished the printer standard, which took the odd-model tickets from about twenty-two a month to five. Between them, with the scanners, the hour was returning about twenty-six hours a month against its cost of about twenty-two. That is the break-even, and it arrived at the end of the second quarter as the agreement had said it might. The third quarter's candidates were slower, because the cheap ones had been taken. The hour's return rose only to about thirty hours a month. That was enough for Ines to ask that the hour become ninety minutes, and enough for the head of IT to say yes without a meeting. The fourth quarter, at seven and a half hours a week, removed two more causes and started the maintenance calendar from the previous article. The maintenance calendar is where the hour goes once the cheap causes are gone.

Two honest footnotes belong on that story. The hour paid back at the desk level after two quarters even though every individual candidate paid back in weeks. That is because the hour is also spent on the audit, the list, the loop, and the moved hours. It is also spent on the candidates that turn out to be harder than they looked. A case that quotes only the candidates' payback is overclaiming. And the return was measured by counting tickets by cause before and after, with a control type and the counterfactual stated. That is slower and less flattering than counting the whole drop in the queue and is the only version leadership should be shown. These are worked numbers from a fictional desk, in ranges a different desk should expect to see differently. The shape, nothing for a quarter and then a slope, is the part that travels.

A Short War Story: The Borrowed Hour at Bluewater Bank

Bluewater Bank's branch desk of four was given a prevention hour each at the start of a quarter. It came from a head of IT who meant it and a desk lead called Dmitri who meant it even more. There was no agreement, because everyone was agreed. In the first week a branch manager rang during Dmitri's hour and he took the call, because it was only one call. In the second week the queue hit forty on a Tuesday and two of the hours were "pushed to Thursday". Thursday had its own queue. By week six the hours were being taken about one week in three. By week ten the technicians had stopped putting them in the calendar because the calendar had started to feel like a reproach. At the end of the quarter, the head of IT asked what prevention had achieved. The honest answer was that about eleven of the fifty-two hours had been taken and the audit was half done. The hour was withdrawn, with regret, on the grounds that it did not seem to work. The four causes that would have removed about sixty tickets a month stayed in the queue for the next year, costing the desk something like three hundred hours. Nobody had taken the hour from the desk. The desk had lent it to the queue, one reasonable ten minutes at a time. An hour that can be borrowed by anyone with a phone is not protected by anything.

The Prevention-Hour Agreement

The agreement below is one page, signed by the manager and the desk, and pinned where the roster is. Section A is the hour itself: who, when, and that it sits on an off-queue day. Section B is the protection: the three interruptions, the move rule, the lost-hour report. Section C is the technician's side, which is the list and the note. Section D is the manager's side, which is the defence, the monthly line and the queue shift. Section E is what everyone agrees to expect, written before the first hour. That way, the first quarter is judged against what was said and not against what was hoped. Review it at the end of each quarter; the only line that should change often is the length of the hour.

THE PREVENTION-HOUR AGREEMENT — ONE PAGE
Desk: ______________________   In force from: ____________   Agreed by (manager): ______________   and the desk: ______________

A. THE HOUR
   Each technician has ______ minutes a week for removing causes, at a fixed time, on a day
   when they are neither on queue duty nor morning backup.
   Technician ______________  hour: ____________ at ______    Technician ______________  hour: ____________ at ______
   Technician ______________  hour: ____________ at ______    Technician ______________  hour: ____________ at ______
   Technician ______________  hour: ____________ at ______    Lead ______________  hour: ____________ at ______
   The hour is in the shared calendar and on the queue-duty roster.

B. THE PROTECTION
   The hour may be interrupted only by:
     1. a major incident, declared by ______________
     2. two or more technicians out at once, leaving no backup
     3. a highest-priority ticket (one that stops a site or a process) with nobody else free
   Nothing else interrupts it: not a full queue, not a direct call, not a senior requester,
   not the technician's own judgement that the queue needs them more.
   An interrupted hour is moved, in writing, before the technician leaves their desk, to a
   time within the same week. An hour not taken by the end of the week is a lost hour.
   Lost hours are reported at the monthly loop with their reason, and the reasons are read together.

C. THE TECHNICIAN'S SIDE
   The hour is spent on a named line of the prevention candidates list, chosen before it starts.
   The hour is not spent on the queue "to clear a few first", nor on work that is not on the list.
   Every hour ends with a note on the candidate: what was done, what was found, what is next.

D. THE MANAGER'S SIDE
   The manager answers for the hour to requesters, to the technician's conscience and to leadership.
   The manager reports the hour monthly, in one line beside the queue numbers: hours spent,
   causes removed, counts before and after.
   The manager holds a queue shift of ______ each week.
   The manager reviews lost hours monthly; three in a month with "queue busy" as the reason is a
   protection failure to be fixed, not a technician to be spoken to.

E. WHAT TO EXPECT (written before the first hour)
   Month 1: the audit and the candidates list; nothing removed.
   Month 2-3: the first cheap cause removed; the first count that moved.
   Quarter 1: response time slightly up (about ______); hours returned ______ a month by its end.
   Quarter 2: break-even on hours expected around ____________.
   Quarter 3 onward: the hour may grow to ______ if the return supports it.
   Measured by: ticket count by cause, before and after, with a control type; never the whole queue's drop.

Reviewed at the end of each quarter. Next review: ____________

Noor let the phone ring to voicemail, sent the depot manager the ticket number with "Petra has this today", and went back to the firmware. The firmware work took the rest of the hour and the first twenty minutes of the next one. The depot manager was fine. He had, it turned out, only rung Noor because her number was the one he had.

Frequently Asked Questions