Unbilled Guard Hours: How to Find the Shifts Your Security Company Never Invoiced

Unbilled guard hours are found the same way almost every time: line up paid hours against billed hours for the same site and the same week, then investigate every hour that exists in payroll but not on an invoice. Payroll is the anchor because it is the one record nobody forgets to file. A guard will chase a missing paycheck. Nobody chases a missing invoice line. That asymmetry is where the money hides.

Everything below is the practical version of that match: the one number to compute first, the eight places hours actually disappear, how to join records that were never designed to be joined, and what to do with the gaps once you have them.

Compute the bill ratio before you compute anything else

For each site, for each month, divide billed hours by paid hours.

That single number tells you where to look. Do not get attached to its absolute value. Every guard company has legitimately non-billable time: orientation, training, internal meetings, travel that the contract does not cover, and post coverage the client refused. What matters is the variance. If a site runs at 0.97 for six months and then drops to 0.82, something changed, and it is usually not the client cutting coverage. It is a post that got added by phone, an overtime week that went out at straight rate, or a shift that fell off the end of the billing period.

Rank your sites by the size of the gap in hours, not by the ratio. A 2 percent gap on a 24/7 site with three posts is worth far more than a 20 percent gap on a site that gets eight hours a week.

The three records that have to agree

Most guard companies keep three separate stories about the same shift:

1. The schedule. What was supposed to happen. Useful, but it is a plan, and plans get overridden by a supervisor at 6pm on a Friday.
2. Timekeeping and payroll. What actually happened, or at least what you paid for. Clock-in and clock-out data, tour or checkpoint scans, approved timesheets.
3. Invoicing. What you asked the client to pay for.

Underbilling is the gap between record two and record three. Overbilling risk is the gap between record one and record two. Both are worth watching, but if you only have time for one pass, do the paid-versus-billed pass. It is the one that pays for itself.

Where the hours actually go

Eight patterns account for most of what I have seen go missing at guard and facility services companies. Work them in this order, because they are roughly ordered by how much money they hide.

Off-schedule coverage approved verbally or by text. A client calls the branch manager and asks for an extra body on Saturday. The guard gets paid. The approval lives in somebody's phone. There is no work order, so the billing run never sees it. This is usually the single largest bucket.

Overtime billed at the straight rate. Under the federal standard, non-exempt employees earn overtime past 40 hours in a workweek, and some states add daily overtime rules on top of that. Whether you can pass a premium through to the client depends entirely on your contract. Read the rate schedule. If it allows an overtime bill rate and your invoices show straight rate on weeks where payroll shows a premium, that delta is recoverable.

Holiday and special-event rates. Same failure, different trigger. The contract names a holiday list and a multiplier, and the billing system uses a flat rate table that does not know about the calendar.

Overnight shifts at the period boundary. A shift that starts at 2200 on the 31st and ends at 0600 on the 1st gets assigned to one period by payroll and a different one by billing, or gets dropped by both. Check every site whose posts cross midnight.

Contract escalations that never took effect. The agreement says the rate increases on the anniversary date. The rate table still holds last year's number. Every hour since that date is underbilled, and the fix is arithmetic, not archaeology.

Contractual extras that nobody enters. Call-out minimums, standby, court and deposition time, training the client agreed to fund, vehicle or patrol charges, equipment pass-throughs. These sit in the contract and never make it into the recurring invoice template.

Credits and voids that were never reversed. A client disputes a week, you credit it, the dispute resolves in your favor, and the reissue never happens.

Post changes that outlived the paperwork. A site goes from two posts to three in March. The schedule and payroll both know. The billing template still says two.

Doing the match when the records do not line up

The join is conceptually simple and practically annoying, because these systems were never designed to talk to each other. Export payroll or timekeeping detail, export invoice line detail, and start here:

-- Hours paid but never invoiced
SELECT p.site_id, p.shift_date, p.post, p.employee_id, p.paid_hours
FROM   paid_hours p
LEFT JOIN invoice_lines i
       ON  i.site_id      = p.site_id
       AND i.service_date = p.shift_date
       AND i.post         = p.post
WHERE  i.id IS NULL
ORDER BY p.site_id, p.shift_date;

Four things will break that query, and all four are worth fixing once:

Site identity. The same location is "Riverside DC 4" in scheduling, "RIV-04" in payroll, and "Riverside Distribution Center" on the invoice. Build a crosswalk table mapping every system's identifier to one canonical site id. Maintain it deliberately. Do not fuzzy-match in production, because a wrong match creates a false recovery claim, and a false claim in front of a client costs you more than the hours were worth.

Midnight. Store shifts as start and end timestamps, not as a date plus hours. Then attribute hours to a period by interval overlap rather than by the start date. This one change eliminates the boundary bucket entirely.

Aggregated invoices. Many invoices carry one line per site per week, not one line per shift. When that is true, the shift-level join returns everything and proves nothing. Fall back to totals: sum paid hours and billed hours by site and week, and flag any week where the difference exceeds a threshold you set per site. Investigate those weeks by hand.

Rounding and grace periods. Clock systems round. Billing may round differently, or not at all. Set a tolerance (a few minutes per shift) so the exception queue is not flooded by noise you will never bill.

The output you want is not a report. It is a queue: one row per suspected gap, with a status, an owner, and a resolution. A report gets read once and forgotten. A queue gets worked.

Turning a gap into an invoice

Do not send a client a spreadsheet of everything you found. Build an evidence packet per site: the shift, the guard, the clock record, the tour or checkpoint data if you have it, the signed post log, and the approval (the email, the work order, the text message). Then send one supplemental invoice per site with a short, plain cover note that says what the coverage was, who asked for it, and when.

Before you send anything, read two clauses in the contract. First, any limit on how far back you may bill. Second, the dispute and audit window. Some agreements cap retroactive billing, and it is better to know that before you pick a lookback period than after you have promised your own team a recovery number.

Expect to write some of it off. Coverage you cannot evidence is not a claim, it is a lesson.

Stopping the leak

Finding the hours once is a project. Not losing them again is a control. Four that work:

• Close weekly, not monthly. Memory of a Saturday fill-in is good on Monday and gone in three weeks.
• Require a reference on every off-schedule shift. No work order or approval id, no schedule entry, and the supervisor gets the exception, not the billing clerk.
• Give the rate table effective dates, and run an automated check for contracts past their escalation date still billing the old rate.
• Run the reconciliation before invoicing, not after. A gap caught pre-invoice is a correct invoice. A gap caught post-invoice is a conversation.

FAQ

How far back should I look? Start with the last complete quarter, because the records are fresh and the people involved still remember. Extend only where the pattern proves itself and the contract allows retroactive billing.

What if I do not have clock-level data, only approved timesheets? Timesheets still work. You lose the ability to match by post, so run the weekly totals comparison instead and accept a coarser result. It will still surface the large gaps.

Will clients get angry about back-billing? Some will, and being right is not the same as being trusted. Lead with the approval record rather than with the amount, keep each packet to a single site, and never send a claim you cannot fully evidence. One unsupported line makes the client doubt every supported one.

Is this worth automating? Yes, once you have run it manually twice. The first two passes teach you what your data actually looks like, and every rule you would have guessed at up front will turn out to be slightly wrong.

Where does the overbilling risk fit in? The same join, read in the other direction: invoice lines with no matching paid hours. Run it. Finding your own errors before an audit does is worth more than the hours it costs you.