Backlog triage
"How many open tickets do we have" is the wrong question, and the number that
answers it is close to meaningless. An open-ticket count mixes together work that is
legitimately parked, work waiting on the customer, spam that will never close, and
a small number of genuinely abandoned customer requests that are the entire reason
anyone asked.
The useful question is: which conversations have a customer waiting on us, and how
long have they been waiting?
Why the naive count misleads
- It counts work waiting on the customer. In most helpdesks a large share of
"open" work is parked awaiting a reply. Including it makes the backlog look
frightening and hides the part that is actionable.
- It counts spam and automation. Notification emails, no-reply bounces,
accounts-payable traffic and marketing blasts open tickets that nobody will ever
work. On a real backlog these can dominate the "never touched" bucket entirely,
which is why the untouched count on its own convinces nobody.
- It has no age distribution. A thousand tickets a day old and a thousand a
month old are different situations with the same count.
- It measures a stock, not a flow. A stable backlog with high throughput is
healthy. Report arrivals, closures and the resulting net change alongside the
level, or the number cannot be interpreted.
The four segments that matter
Segment by who owes the next action, and age from the last action on your
side — not from ticket creation. Creation age is dominated by long-parked work
and tells you nothing about neglect.
1. Never touched. No human agent action, ever. The highest-severity segment and
the one most contaminated by noise, so it needs the filtering below before it means
anything.
2. Stalled on us. A customer action is the most recent event, and no agent has
responded since. This is the real backlog. Age from the customer's last message.
3. Waiting on customer. We acted last and are waiting. Report it separately.
Worth checking for a follow-up policy: work parked indefinitely with no chase is
functionally abandoned even though the status looks correct.
4. Bot-only, human never involved. The customer has exchanged messages with an
automated agent and no human has ever replied. Escalate the subset where the
customer explicitly asked for a human, or expressed frustration, and did not get
one. This segment does not appear in any status-based view, and it is where the
worst customer experiences hide.
Separating dropped requests from noise
This is the analytical work in backlog triage, and skipping it is why untouched-
ticket reports get dismissed.
For the never-touched population, classify rather than count:
- Tag signals. Find the tags that mark automation, spam, notifications and
bulk traffic in this account, and quantify each. Do not assume tag names — derive
the most common tags on untouched work and inspect them.
- Customer linkage. An untouched conversation linked to a known customer or
company account is far more likely to be a real dropped request than one from an
unrecognised sender. This is usually the strongest single signal.
- Subject and first-message shape. Sample subjects across the untouched set and
characterise them. Auto-generated subjects cluster hard and are easy to name.
- Channel. Untouched voice and chat mean something different from untouched
email — an abandoned chat may be a customer who left, which is a routing or
staffing finding rather than a neglect finding.
Report the untouched count twice: raw, and after exclusions, with the exclusion
rules named. The gap between them is usually large, and stating both is what makes
the filtered number credible.
Data required, and the traps in it
- Status semantics are not portable. "Pending" means awaiting-customer in some
helpdesks and awaiting-agent in others; "on hold" and "solved-but-reopenable" vary
the same way. Derive who-owes-the-next-action from message events, not from
the status field, and use status only as a cross-check. Where you must use status,
state the mapping you assumed.
- Internal notes are actions. A ticket where an agent left an internal note has
been touched, even though the customer saw nothing. Whether that counts as a
response depends on the question: for "did we neglect this" it counts; for "did
the customer hear from us" it does not. Decide, and say which.
- Business hours, not calendar hours, for anything framed as a service
expectation. A Friday-evening arrival is not eight hours late on Saturday morning.
Get the schedule and the holiday calendar; if you cannot, report calendar hours
and label them.
- Timezones. Aging arithmetic across a timezone boundary is off by hours, which
matters enormously at short thresholds and not at all at long ones.
- Bot and system accounts look like agents. If an automated replier counts as
an agent action, your untouched count collapses to almost nothing and the report
is wrong in the reassuring direction. Identify these accounts explicitly and
validate against a sample rather than trusting a single author-type field.
- Merged and duplicate conversations. A merged ticket can look abandoned while
the work continued elsewhere. Resolve duplicate pointers before reporting age.
Ranking by risk, not by age
Age alone puts the oldest parked spam at the top. Rank the "stalled on us" segment
by a combination of:
- Time waiting, in business hours, against the expectation for that queue
- Whether the customer has followed up — a second unanswered message is a much
stronger signal than a long first wait
- Explicit escalation language, a complaint, a regulator mention, or a
cancellation threat
- Customer value or tier, if available
- Whether anyone owns it — unassigned work has nobody to chase
Unassigned + open + customer-waiting is the highest-yield single filter in most
backlogs, and it is usually a routing rule failure rather than an agent problem.
Check whether the unassigned population clusters on a queue, a tag or a time of day
before concluding anything about people.
Present results to the user
- The level and the flow — backlog size, arrivals, closures, net change over
the window. A level without a flow cannot be interpreted.
- The four segments, with counts and the who-owes-next-action rule you used.
- Never-touched, raw and filtered, with the exclusion rules and what the
excluded traffic actually was.
- The ranked action list — the specific conversations with a customer waiting,
worst first, by id, with time waiting and why each ranks where it does. This is
the part someone will work from, so keep it short enough to work through today.
- Bot-only strandings, separately, with the subset that asked for a human.
- Systemic findings — unassigned clusters, queues with no owner, follow-up
policies not firing, integrations creating ticket noise. These fix the backlog;
the action list only drains it.
- What you could not determine — status mappings assumed, business hours
unavailable, accounts you could not classify.
Cite ids and counts. Do not paste conversation text into chat.
1---2name: cx-backlog-triage3description: Use to analyse a support backlog and find the conversations actually at risk — never-touched tickets, work stalled on your side, customers stranded with a bot, and unassigned open work. Trigger for "report on our open tickets", "daily outstanding tickets report", "how many tickets have we not responded to", "find tickets waiting on us", "customers stuck with a bot and no human", aging backlog, or a backlog that keeps growing.4---56# Backlog triage78"How many open tickets do we have" is the wrong question, and the number that9answers it is close to meaningless. An open-ticket count mixes together work that is10legitimately parked, work waiting on the customer, spam that will never close, and11a small number of genuinely abandoned customer requests that are the entire reason12anyone asked.1314The useful question is: **which conversations have a customer waiting on us, and how15long have they been waiting?**1617## Why the naive count misleads1819- **It counts work waiting on the customer.** In most helpdesks a large share of20 "open" work is parked awaiting a reply. Including it makes the backlog look21 frightening and hides the part that is actionable.22- **It counts spam and automation.** Notification emails, no-reply bounces,23 accounts-payable traffic and marketing blasts open tickets that nobody will ever24 work. On a real backlog these can dominate the "never touched" bucket entirely,25 which is why the untouched count on its own convinces nobody.26- **It has no age distribution.** A thousand tickets a day old and a thousand a27 month old are different situations with the same count.28- **It measures a stock, not a flow.** A stable backlog with high throughput is29 healthy. Report arrivals, closures and the resulting net change alongside the30 level, or the number cannot be interpreted.3132## The four segments that matter3334Segment by **who owes the next action**, and age from **the last action on your35side** — not from ticket creation. Creation age is dominated by long-parked work36and tells you nothing about neglect.3738**1. Never touched.** No human agent action, ever. The highest-severity segment and39the one most contaminated by noise, so it needs the filtering below before it means40anything.4142**2. Stalled on us.** A customer action is the most recent event, and no agent has43responded since. This is the real backlog. Age from the customer's last message.4445**3. Waiting on customer.** We acted last and are waiting. Report it separately.46Worth checking for a follow-up policy: work parked indefinitely with no chase is47functionally abandoned even though the status looks correct.4849**4. Bot-only, human never involved.** The customer has exchanged messages with an50automated agent and no human has ever replied. Escalate the subset where the51customer explicitly asked for a human, or expressed frustration, and did not get52one. This segment does not appear in any status-based view, and it is where the53worst customer experiences hide.5455## Separating dropped requests from noise5657This is the analytical work in backlog triage, and skipping it is why untouched-58ticket reports get dismissed.5960For the never-touched population, classify rather than count:6162- **Tag signals.** Find the tags that mark automation, spam, notifications and63 bulk traffic in this account, and quantify each. Do not assume tag names — derive64 the most common tags on untouched work and inspect them.65- **Customer linkage.** An untouched conversation linked to a known customer or66 company account is far more likely to be a real dropped request than one from an67 unrecognised sender. This is usually the strongest single signal.68- **Subject and first-message shape.** Sample subjects across the untouched set and69 characterise them. Auto-generated subjects cluster hard and are easy to name.70- **Channel.** Untouched voice and chat mean something different from untouched71 email — an abandoned chat may be a customer who left, which is a routing or72 staffing finding rather than a neglect finding.7374Report the untouched count **twice**: raw, and after exclusions, with the exclusion75rules named. The gap between them is usually large, and stating both is what makes76the filtered number credible.7778## Data required, and the traps in it7980- **Status semantics are not portable.** "Pending" means awaiting-customer in some81 helpdesks and awaiting-agent in others; "on hold" and "solved-but-reopenable" vary82 the same way. Derive who-owes-the-next-action from **message events**, not from83 the status field, and use status only as a cross-check. Where you must use status,84 state the mapping you assumed.85- **Internal notes are actions.** A ticket where an agent left an internal note has86 been touched, even though the customer saw nothing. Whether that counts as a87 response depends on the question: for "did we neglect this" it counts; for "did88 the customer hear from us" it does not. Decide, and say which.89- **Business hours, not calendar hours**, for anything framed as a service90 expectation. A Friday-evening arrival is not eight hours late on Saturday morning.91 Get the schedule and the holiday calendar; if you cannot, report calendar hours92 and label them.93- **Timezones.** Aging arithmetic across a timezone boundary is off by hours, which94 matters enormously at short thresholds and not at all at long ones.95- **Bot and system accounts look like agents.** If an automated replier counts as96 an agent action, your untouched count collapses to almost nothing and the report97 is wrong in the reassuring direction. Identify these accounts explicitly and98 validate against a sample rather than trusting a single author-type field.99- **Merged and duplicate conversations.** A merged ticket can look abandoned while100 the work continued elsewhere. Resolve duplicate pointers before reporting age.101102## Ranking by risk, not by age103104Age alone puts the oldest parked spam at the top. Rank the "stalled on us" segment105by a combination of:106107- **Time waiting**, in business hours, against the expectation for that queue108- **Whether the customer has followed up** — a second unanswered message is a much109 stronger signal than a long first wait110- **Explicit escalation language**, a complaint, a regulator mention, or a111 cancellation threat112- **Customer value or tier**, if available113- **Whether anyone owns it** — unassigned work has nobody to chase114115Unassigned + open + customer-waiting is the highest-yield single filter in most116backlogs, and it is usually a routing rule failure rather than an agent problem.117Check whether the unassigned population clusters on a queue, a tag or a time of day118before concluding anything about people.119120## Present results to the user1211221. **The level and the flow** — backlog size, arrivals, closures, net change over123 the window. A level without a flow cannot be interpreted.1242. **The four segments**, with counts and the who-owes-next-action rule you used.1253. **Never-touched, raw and filtered**, with the exclusion rules and what the126 excluded traffic actually was.1274. **The ranked action list** — the specific conversations with a customer waiting,128 worst first, by id, with time waiting and why each ranks where it does. This is129 the part someone will work from, so keep it short enough to work through today.1305. **Bot-only strandings**, separately, with the subset that asked for a human.1316. **Systemic findings** — unassigned clusters, queues with no owner, follow-up132 policies not firing, integrations creating ticket noise. These fix the backlog;133 the action list only drains it.1347. **What you could not determine** — status mappings assumed, business hours135 unavailable, accounts you could not classify.136137Cite ids and counts. Do not paste conversation text into chat.