The three-week gap: what MSPs discover after the project closes

There is a predictable window after a project closes, usually two to four weeks, in which the gaps surface. A user cannot log in because their license is wrong. A ransomware alert fires on a machine that has no EDR. A restore is requested from a server whose backup never ran. Each one arrives as a ticket, and each one is charged to nobody.

Where the gap comes from

Projects close when the last ticket does. The last ticket closes when the engineer believes the work is done. Belief is formed at a moment in time, on the machines that happened to be reachable, from a console that happened to be open. The environment is larger than that moment.

What it costs

Rework hours on fixed-price work, which is margin. Escalations, which are trust. Security exposure, which is the one that ends relationships. And the slow erosion that comes from a client learning they cannot rely on "done" meaning done.

Closing it

The fix is not more diligence at closing. It is a different question at closing: not "is every ticket closed?" but "does the environment match what we promised, and can we show it?" Answered from the systems, with evidence, that question closes the window before the client opens it.