Blog · 11 September 2026 · Jon McLachlan

The agreement said 40 hours. The month said 47.

A retainer of 40 hours a month at €4,500, priced for 30 billable hours. By month three the team delivered 47, and only 32 of them were in the statement of work. Margin went from a planned 28% to 11%, and the owner decided the fix was higher rates. It was not. What scope creep looks like inside a firm that sells time, where the agreement goes after it is signed, and how a firm makes the agreement hold at the hour. With nine recordings, three quotes from X, three figures and seven books.

Scope creep is work delivered beyond what the agreement priced, without a matching change to the price. A statement of work is the document that was supposed to prevent it: the deliverables, the hours or the fee, the assumptions, the rules for changing any of them. A change order, or change notice, is how the rules get changed. Every firm that sells time has all three. The problem is where they live. The statement of work is a PDF in a folder, the change order is a template nobody has opened since the onboarding, and the rules are in the owner’s memory, which is where the client’s small request lands on a Thursday afternoon.

She has signed a hundred of these. The fractional CFO whose retainer says twenty hours and whose September said twenty-nine. The security boutique operator whose penetration test grew a second environment halfway through. The agency principal whose “one more revision” is on its fourth round. She wrote a good agreement. It is just not in the room when the hour is worked.

Forty hours sold. Forty-seven delivered.

In May 2026 an agency owner in r/agency described a client whose retainer margin had come in at 18 to 22 percent. The owner’s first instinct was to raise rates. Six months later the firm had lost 30 percent of its clients and the rest were grumbling at every change order. The poster’s diagnosis, which the thread’s 71 comments largely accepted: “below 25 percent retainer margin is rarely a pricing problem, it’s a discovery problem.” Then the example. A retainer of 40 hours a month at €4,500, priced at 75 percent billable, so 30 billable hours expected. Month three, actual delivery 47 hours. “of those 47, only 32 were in the SOW. other 15 were small stuff. quick fixes, small changes, while you’re in there can you also do X. margin collapsed from projected 28 percent to actual 11 percent.” And the line that matters: “raising rates wouldn’t have fixed it. the 15 hours of out of scope work would still happen.”

The numbers around that story are not kind. The Project Management Institute reported in 2018 that 52 percent of projects completed in the previous twelve months had experienced scope creep or uncontrolled changes to scope, up from 43 percent five years earlier. McKinsey and the University of Oxford, studying more than 5,400 large IT projects in 2012, found they ran on average 45 percent over budget and 7 percent over time while delivering 56 percent less value than predicted. Closer to firms of ten, Ignition’s 2025 survey of 273 agency leaders found 57% losing $1,000 to $5,000 a month to unbilled work, 30% losing more than $5,000 a month to scope creep, and 78% saying they rarely or only sometimes charge for out-of-scope work. Its 2022 survey of 506 American accounting firms found 88% had delayed or avoided the awkward conversation, and 43% simply absorbed the work.

Bent Flyvbjerg has spent a career on the largest version of the problem. His database of more than 16,000 projects in 136 countries produced what he calls the iron law of megaprojects, that they run over budget and over time, over and over again, and his 2023 book with Dan Gardner, How Big Things Get Done, is about the handful that did not. The lesson that survives the trip from a rail tunnel to a forty-hour retainer is his first one: think slow, act fast. The time to decide what is in scope is before the work, when a change costs a conversation, not during it, when a change costs fifteen hours nobody billed.

A change notice, ready to go.

The r/consulting thread on scope creep, 128 points, is mostly gallows humor, but the practical replies agree on one thing: the answer to a new request is a document, not a discussion. u/waffles2go2: “SOW is my bible, if you want ARCs we can do that, but if it’s not in scope, and we don’t have the hours? Nope, nope, nope.” u/lawtechie on the request that always comes: “My favorite is when the client will demand something that they wanted but cut out of the SOW to meet budget.” And u/Wheres_my_warg on the method: have a change notice ready to go, greet the request warmly, send the notice the same afternoon with thankful language, and “usually, you get paid for it, or they back off and you at the least have a paper trail.”

The freelancer who lost $2,300 on a landing page learned the same lesson at retail price. Hired for twenty hours at $100, they said yes to a blog section, a new color scheme and one more copy revision, and delivered forty-three hours for $2,000. The top reply, at 102 points, reframed the request as good news with a condition: “It’s a good sign the client is asking you to do more work. That also means that you should communicate up front that those activities are additional work that will be billed accordingly. Without their written approval you won’t be doing the work.” Another put the client’s side plainly: “Most of the time clients expect that it’s going to cost more, but if you don’t say anything, neither are they.”

Michael Janda ran a creative agency for years before selling it, and his eight minutes on charging for changed scope is the agency version of the same method: a detailed agreement, a watch on the hours as they happen, and an addendum for every change, signed before the work.

Google’s Project Management Certificate teaches the same thing to people who will manage scope from inside a company rather than sell it. Stanton, a program manager at YouTube, tells the story of a project whose scope changed at the last minute and what he did about the people, which is the half of scope creep that no document handles.

Two people who have watched a great deal of scope creep said it shorter, on X. Jonathan Stark, in April 2021:

And the satirical trade paper Adweak, in a headline from August 2018 that 480 agency people recognized: “Clients Can’t Help But Burst Into Laughter After Agency Explains That Latest Request Is ‘Out Of Scope’.”

The agency podcasts have covered the same ground for years. Drew McLellan’s Build a Better Agency had Ryan Meo on in September 2021 to talk about scaling without scope creep, and Meo’s line has stuck: “The only way to scale a service-based business is by learning how to say ‘no’ appropriately.” Jonathan Stark’s Ditching Hourly spent three minutes in December 2020 on avoiding scope creep on a value-priced project, and the answer was the one in this post: define the scope by outcome and write the change process into the agreement. Parakeeto’s Agency Profit Podcast went deepest, with Tiffany Kemp, a contracts specialist, on the clauses that hold.

Do the hours roll over?

The retainer is where the agreement is vaguest, because it was sold as availability and is delivered in hours. Google’s own autocomplete for “retainer hours” offers “do retainer hours roll over,” and r/freelance asks it regularly. In 2022 a freelancer on a ten-hour retainer asked what happened to the money in months with less than ten hours of work. The 34-point answer: “Typically, the money is yours, as the point of retainer fees is that the client is paying to reserve your time.” Then the only question that ever settles it: “What does your contract say?”

In January 2026 a developer proposed moving all their occasional clients onto a five-hour monthly retainer with no rollover, and the replies were unanimous that the no-rollover clause was the whole point. “No rollover is key, otherwise you’ve just made your deadline problems worse,” wrote u/unwavering. u/jfranklynw added the sales language and the trap: pitch it “as priority access to your time rather than a prepaid block of hours,” because when you just say hours do not carry over, “some clients hear ‘I’m paying for nothing in quiet months.’” The overflow question got its answer in a 2021 thread from u/boycottSummer: tell the client when they are close to the end of the retained hours, have an hourly rate that starts after that, and take a deposit for the next block.

MSPs have the same argument under a different name. Block hours or block money, asked r/msp in 2025. u/Beauregard_Jones was unimpressed by both: “Block hours is just another form of break-fix. They’re paying in advance for your hourly work.” u/CK1026 saw the deeper cost: “If you go back to selling time, you’re not selling the outcome anymore… you’ll have to justify any time you spend.” And u/Joe-notabot asked the question the contract has to answer and usually does not: what happens at the end of the month, do the hours or the money roll over. Even the rounding is a clause. In a 2021 thread on billing increments, one freelancer rounded to fifteen minutes in business hours and sixty after hours, and added the sentence that makes it enforceable: “Both of those intervals are in my contract.”

The quiet month is the retainer’s other failure. In 2019 a designer on a twenty-hour retainer asked r/freelance what to do about a month with less than twenty hours of work, and the top answer, at 69 points, was the definition: “you are paid to be available for those 20 hours, whether you have the work or not… you would effectively have to say no to other work.” The practical reply came from u/crabthief: “during weekly calls, I make sure to inform the client about the amount of hours left.” That sentence is the whole discipline. The client who knows the count every week never asks where the hours went.

Some firms are giving up on the model. Two days before this post went up, an agency owner in r/agency was ready to drop the retainer model in favor of a ninety-day handover, and the most useful reply was caution: “retainers get messy… I’d test it on one account before you blow up the model that pays rent.” In r/msp this February, an owner whose client refused to use the services it was paying for heard from a peer who reads that as a signal: when clients start doing the work themselves, it is the first sign they will not renew. A retainer the client is not using is a retainer the client is already re-pricing in their head.

The pricing people say the retainer is the most misunderstood contract in professional services. Michael Zipursky, whose Consulting Success firm surveys consultants every year, warns that “without clear boundaries, retainer relationships can quickly turn into unlimited consulting for a fixed fee,” and that “hours-based retainers train the client to watch the clock and roll over unused time, which erodes the relationship.” Taylor Crane of Fractional Jobs, who sizes the standard fractional retainer at $10,000 a month for about ten hours a week, names the retainer’s cost in one line: “There’s a natural incentive for scope creep, which means you’re working for less than you expected.” Dallas Alford, a fractional CFO, gives the fix as contract language: “Document your response times and request types you’ll handle. Also specify extra fees for work outside the retainer scope.” Jonathan Stark’s five minutes on pricing a retainer when the scope is not yet known is the clearest version of the pricing question.

For the document itself, Mike Clayton’s seven minutes on the statement of work covers the forms most firms never use, including the level-of-effort statement of work, which is the honest name for a retainer.

Correcting it after too long.

The hardest version of the problem is the one that has been allowed for years. In June 2025 someone at a growing MSP asked r/msp how to start charging for work that had been free since the founders’ handshake days, without infuriating clients who had done nothing wrong. The best answer, from u/roll_for_initiative_, was a script: “As we grow and get more into shape with formal processes, we’re looking back and seeing that we’re spending a lot of time on X with you guys. That’s technically not included in our bundled service and it’s weighing your numbers down.” u/Kawasakison asked the first question, “What’s in the contract?” u/TBTSyncro offered the quietest fix: “Document time spent on ‘non-billable’ work, and give them regular reports. Let it be their decision.” And one owner preferred a different conversation entirely: “I’d rather have a conversation of having to go up on rates because of inflation or some other reason than trying to explain your going to start charging for something that’s been free.”

Thomas Ptacek, who co-founded two security consultancies, described the professional standard in a 2024 Hacker News comment: “When your project blows up, the professional thing to do is to resolve the problem with the client before billing another hour over the SOW.” The alternative, he wrote, is optimistic invoicing, and the other alternative is the one Dillon Towey of Franchise Resource described to Ignition in 2023: a $600-a-month fixed fee sized for six hours that regularly took eight, ten or twelve, and for a long time the firm would “just take it in the shorts.” Nicolaas Spijker of Rock put the whole mechanism in one sentence in April 2026: “Budgets do not go over all at once. They go over in small, invisible increments that add up in month three.”

David C. Baker and Blair Enns gave an episode of 2Bobs to it in September 2022, under a title we will let them explain. Two lines from it belong in every firm’s onboarding. One: “there is almost always some degree of underpricing and/or over-servicing, which is all tied around scope creep.” And the conclusion: “The firms that are populated with adults who are willing to have difficult conversations are the ones making more money.”

For accounting firms, where the fixed fee meets the client who keeps a shoebox, the Jason On Firms podcast spent five minutes in August 2026 on the one system its host says stops scope creep.

Prove the hours.

When the agreement has not been in the room, the invoice becomes the first place the client meets the hours, and the client counts. In August 2026 an agency owner asked r/agency whether a client had ever asked them to prove the hours behind an invoice, and then ran about twenty-five private conversations on the question. The summary is the best thing written on the subject this year: “The question is common, real disputes are rare. The trigger is usually a bad surprise somewhere else… It is rarely distrust of you specifically. More detail does not settle it. Hours that map to something the client remembers happening do.” One reply’s example became the thread’s shorthand: “reworked the Q3 plan after your Tuesday call” settles a question that “strategy work, 3 hours” never will. The firms that never get asked, the post concluded, are “the ones whose clients see the work as it happens… When the invoice is the first thing the client has seen since kickoff, the counting starts.”

u/ThatGuytoDeny165 described the agreement doing its job: “we present a plan before we start with a list of things we are doing… that the client signs off on as the scope of work and how we plan to use their hours. Once they sign that it doesn’t matter.” Shawn Jahromi, who runs a management consulting company, told Clockify in December 2025 how he checks a contractor’s invoice: “we check alignment between story, tickets, and calendar, not minutes.” The hours have to map to events. The agreement has to have been visible while the events happened.

There is a school that says the whole idea is a mistake. Allen Holub, who teaches agile software development, put it this way in December 2022:

He is right about software a company builds for itself and half right about work a firm does for a client. Scope can change every week if the price changes with it. What a firm that sells time cannot survive is scope that changes while the fee stays where the agreement left it, and the agreement is the only thing that connects the two.

What the books say.

The agreement shelf is older than the pricing shelf, and most of it was written by consultants about consulting.

• Flawless ConsultingPeter Block, fourth edition, Wiley, 2023. The contracting conversation, which is where scope is actually decided, and how to have it as an equal.
• Managing the Professional Service FirmDavid H. Maister, 1993. Still the book on how a firm of experts makes money, including the arithmetic of the engagement.
• The Trusted AdvisorDavid H. Maister, Charles H. Green and Robert M. Galford, twentieth anniversary edition, 2021. Why the client who trusts you does not count your hours, and how that trust is earned in the first meeting.
• How Big Things Get DoneBent Flyvbjerg and Dan Gardner, 2023. Think slow, act fast, from the largest database of project outcomes there is.
• Getting to YesRoger Fisher, William Ury and Bruce Patton, revised edition, 2011. The change-order conversation as a negotiation about interests rather than positions.
• Burn Your PortfolioMichael Janda, 2013. The agency owner from the recording above on the parts of the business that school never taught, contracts included.
• The Business of ExpertiseDavid C. Baker, 2017. Positioning, which is what lets a firm say no to the fifteen hours in the first place.

The agreement as rules, not a PDF.

We ran a security consultancy on those agreements: caps in a contract, rules in cells, the change order a template we meant to use. The month it failed us is in The invoice told us last. Why we built Ceed. What we built treats the agreement as the rules the hours are checked against, at the hour, rather than as a document read at the invoice.

A client’s agreement in Ceed carries the retainer, the budget in hours, the rates by role, the rounding, the discounts and any equity taken as payment. Every hour logged against that client is checked against those rules as it is logged. If an hour would push the client over the budget, Ceed holds it for approval: the hour is saved, marked as held, and put in front of the account leader for a yes or a no that day. Approved, it goes on the invoice at the rate in the agreement, with a name and a date on the approval. Declined, it stays on the record and off the invoice. That is the change notice u/Wheres_my_warg keeps ready to go, produced by the hour itself, on the afternoon the request arrived rather than in month three.

The fifteen hours of “while you’re in there” do not disappear from the record and do not slide onto the invoice. They stack up as held hours with names on them, which is exactly the document u/TBTSyncro wanted to hand the client: the non-billable work, itemized, so the client can decide. The client hears about the extra before the invoice, not on it, so the counting never starts. The retainer’s rollover rule, whichever one the contract chose, is a rule the budget follows rather than a question for the end of the month. And because the invoice is computed from the agreement, an approved hour past the budget appears on it as its own line, at the rate the agreement set for that role.

The rules are yours, and the yes or the no is a person’s. The account leader sees the held hour, decides, and tells the client the way she would have anyway, except on the day it happened. Held. Not hidden. shows what the person who logged the hour sees, They see the fee. You see the hours. is about the private hour budget under a flat retainer, and the pricing side of the 11% margin is in The rate was set on day one. The client grew. Where each tool in the field stands on the crossing is on the comparison page, dated.

Three conversations about the document.

The firm behind Ceed also hosts The Security Podcast of Silicon Valley, 103 conversations since 2021 with the people who build and run security. Three of them are about the documents a firm signs and lives by.

• 51
  Tony Thai, founder and CEO of HyperDraftAugust 2024 · From software engineering to law firm work to automating the documents themselves, including the ones that define scope.
• 37
  Founders’ guide to compliance, with Jon McLachlan and Sasha SinkevichFebruary 2024 · SOC 2, ISO, NIST and PCI for founders, which is where half of a security firm’s scope comes from.
• 14
  Biff Clark, owner of Coefficient TechnologiesMarch 2022 · Fifteen years of running a small security consultancy, agreements included.

Ceed is for firms that sell their team’s time: fractional CFO, CISO, CMO and CTO practices, security and engineering boutiques, consultancies and agencies up to fifty people. If your agreements say forty and your months say forty-seven, sign up and see the product with your own numbers. Nothing to pay until your first invoice.

Sign upOr write to hello@ceed.so.

Questions.

Jon McLachlan is a co-founder of Ceed and of YSecurity, which has delivered forty-seven on a forty. Published 11 September 2026. Corrections to hello@ceed.so, and they are dated when made.