No tickets is not the same as good management

Oct 20, 2026

There are few IT metrics that organisations are happy with. The number of open tickets is one of them. No waiting users, no complaints at the year-end party, so things must be fine.

Feeling certain with an empty queue? Nobody can.

We recently saw the report of a company where IT had been solved problem by problem for twenty years. Every time something did not work, that thing got repaired. And it went well, because the people doing it knew their environment inside out. No tickets, no escalations.

Until an audit came from above, forced by NIS2. The report was downright bad. Not because anyone had cut corners, but because nobody had ever signed off on the whole. Everything ran, nothing was designed.

The toilet on the wrong side

Our favourite image from that conversation: it is a house where the toilet sits on the far side of the bathroom, with pipes running through the entire building. Every part works. Together it is nonsense.

That is how an IT environment grows that gets built per problem instead of per design. A new tool here, a quick fix on top, and after ten years everything still works, but nobody can explain why. Let alone prove that it is safe.

Why this happens

Not because IT teams fail to do their work. But because urgent always wins from important. The director's printer takes priority today over reviewing access rights. Logical, but the consequence is that the structural work keeps getting postponed. In many organisations firefighting mode is not an incident, it is the way the business runs.

And here lies the trap that nobody names: as long as there are no tickets, management assumes everything is under control. The risk quietly keeps running along. Until a customer, an insurer or an auditor asks for proof. That is when it turns out that nobody is responsible for security, and the shock is considerable.

What does say something

Good management is visible. There is someone who can tell you who has admin rights and why. There is a recent overview of who has access to what. There are agreements about what happens when a device is lost or someone leaves the company. There is a report you can show the board without flinching.

That is not a daily occupation for an internal IT manager with a full queue. It is however the work that a security layer on top of the existing IT exists for. Measure, explain, improve. Rebuilding the story of that house does not start with tearing down, it starts with a drawing.

Request an audit if you want to know whether your environment grows along or merely keeps running.