Donald Keller appeals the court of appeals’ decision that he was negligent in the supervision of his employee, Firat Uzan. Koca v. Keller, 97 P.3d 346 (Colo.App.2004). Uzan, acting without Keller’s authorization, brought the plaintiff, a twelve year-old girl, to Keller’s dry cleaning business early on a Sunday morning when it was closed for business, locked her in the office and sexually assaulted her.
We hold that in a claim for negligent supervision against an employer the plaintiff must prove that the defendant knew his employee posed a risk of harm to the plaintiff and that the harm that occurred was a foreseeable manifestation of that risk. While Keller knew or should have known that Uzan posed a risk of harm that he would subject female employees and customers to lewd behavior and sexual contact during business hours, Uzan’s sexual assault of a twelve year-old girl, the daughter of Uzan’s friends, at Keller’s place of business while it was closed and when Uzan was supposed to be alone is not a foreseeable result of the known risk of harm. Hence, we reverse the decision of the court of appeals and remand this case to that court to consider the plaintiffs alternate theory of premises liability.
Facts and Proceedings Below
Donald Keller, defendant below and petitioner before this court, owned and operated a dry cleaning business in Boulder, Colorado. *447Keller hired Firat Uzan, a male employee, in 1990 and then promoted him to the position of General Manager in the spring of 1995. As General Manager, Uzan had keys to the premises and was responsible for operating the dry cleaning business, which included opening and closing the store, in Keller’s absence and at his direction. However, Uzan did not have the authorization to bring third parties to the business during non-working hours.
On a Sunday morning in the spring of 1997, Uzan brought a twelve year-old girl, the plaintiff Tugba Koca, to the business. Testimony revealed that Uzan was a, family acquaintance and had asked Koea’s parents if she could go with him to the dry cleaners and help with opening the doors of the business so that the carpets could be professionally cleaned. While there, Uzan brought Koca into the back office where he locked the door and sexually assaulted her.
Uzan was subsequently convicted of sexual assault of a child and sentenced to the Department of Corrections. The plaintiff then filed this civil action against Keller claiming that Keller, as the employer and owner of the dry cleaning business where the assault occurred, was negligent in his supervision of Uzan. The complaint alleged that Keller knew that Uzan had sexually harassed young women at the cleaners and that despite knowing that “his employee was a sexual predator,” Keller continued to allow Uzan to work alone and unsupervised with his own access to the premises.
The trial court, acting as the finder of fact, found that Keller was negligent in his supervision of Uzan and awarded damages. The court cited testimony from three former women employees who told Keller that Uzan had sexually harassed and fondled them during business hours prior to the incident identified by the plaintiff. The young women related several instances where, during business hours, Uzan asked them to perform sexual acts as well as touched their breasts and buttocks. All three quit their positions and told Keller of the episodes. Additionally, one of the employee’s mothers called Keller warning of civil liability. The three women also complained to police about Uzan’s conduct but the police did not initiate charges against him. When Keller confronted Uzan about these complaints, Uzan denied any sexual misconduct and Keller did not pursue the matter any further.
Keller appealed the trial court’s finding of liability and the court of appeals affirmed. Koca v. Keller, 97 P.3d 346 (Colo.App.2004). The court reasoned that Keller had knowledge of the previous assaults and that “there was a risk that Uzan would sexually assault a young woman pr girl on the premises if left unsupervised.” Id. at 350. Thus, it held that Keller had a duty to take reasonable steps to prevent Uzan from working alone and unsupervised and the breach of this duty resulted in the harm to the plaintiff. Id.
We granted Keller’s petition for certiorari to review the court of appeals’ decision.1
Analysis
The issue that we address is the extent to which an employer owes a duty of care to prevent harm caused by an employee. We begin by setting forth the legal principles that guide us in determining whether an employer is liable in tort for the negligent supervision of his employee.
To establish a claim based on negligence, the plaintiff must show: (1) the existence of a legal duty to the plaintiff; (2) the defendant breached that duty; and (3) that the breach of the duty caused the harm resulting in damages to the plaintiff. Ryder v. Mitchell, 54 P.3d 885, 889 (Colo.2002) (citing Greenberg v. Perkins, 845 P.2d 530, 533 (Colo.1993)); Connes v. Molalla Transp. Sys., Inc., 831 P.2d 1316, 1320 (Colo.1992). A negligence claim fails where the law does not impose a duty on the defendant to act for the plaintiffs benefit. Ryder, 54 P.3d at 889 (citing Greenberg, 845 P.2d at 533, and Per-*448reira v. Colorado, 768 P.2d 1198, 1208 (Colo.1989)). Whether a defendant in a particular negligence action owes a legal duty to the plaintiff is not a question of fact but is a question of law to be determined by the court. Bath Excavating & Constr. Co. v. Wills, 847 P.2d 1141, 1147 (Colo.1993). After the court determines the existence of a legal duty, then the finder of fact is to determine whether the defendant breached that duty. Perreira, 768 P.2d at 1208.
Courts consider a number of factors to determine whether a duty exists, including: the risk involved, the foreseeability of the injury weighed against the social utility of the actor’s conduct, the magnitude of the burden of guarding against injury or harm, and the consequences of placing the burden on the actor. HealthONE v. Rodriquez, 50 P.3d 879, 888 (Colo.2002); Taco Bell, Inc. v. Lannon, 744 P.2d 43, 46 (Colo.1987). “No one factor is controlling, and the question of whether a duty should be imposed in a particular case is essentially one of fairness under contemporary standards — whether reasonable persons would recognize a duty and agree that it exists.” Connes, 831 P.2d at 1320 (quoting Taco Bell, Inc., 744 P.2d at 46).
To establish liability, the plaintiff must prove that the employer has a duty to prevent an unreasonable risk of harm to third persons to whom the employer knows or should have known that the employee would cause harm. Moses v. Diocese of Colorado, 863 P.2d 310, 329 (Colo.1993); Destefano v. Grabrian, 763 P.2d 275, 286-88 (Colo.1988) (adopting doctrine of negligent supervision in Colorado). See also Restatement (Second) of Agency § 213 (1958); and Restatement (Second) of Torts § 317 (1965). An employer “who knows or should have known that an employee’s conduct would subject third parties to an unreasonable risk of harm may be directly liable to third parties for harm proximately caused by his conduct.” Destefano, 763 P.2d at 288.
While the tort of negligent supervision applies to instances where the employee is acting outside his scope of employment,2 it does not extend to all acts undertaken by an employee that are actionable in tort. In cases of negligent supervision “[l]iability of the employer is predicated on the employer’s antecedent ability to recognize a potential employee’s ‘attributed of character or prior conduct’ which would create an undue risk of harm to those with whom the employee came in contact in executing his employment responsibilities.” Moses, 863 P.2d at 327 (quoting Connes, 831 P.2d at 1321). See also, Van Osdol v. Vogt, 892 P.2d 402, 409 (Colo.App.1994) (affirming trial court’s dismissal of negligent supervision claim where defendant did not know of employee’s sexual abuse of a minor) aff'd, 908 P.2d 1122 (Colo.1996); Restatement (Second) of Agency § 213 emt. d (“Liability results under the rule stated in this Section, not because of the relation of the parties, but because the employer ante-cedently had reason to believe that an undue risk of harm would exist because of the employment.”); Restatement (Second) of Torts § 317 cmt. b (“[T]he master as such is under no peculiar duty to control the conduct of his servant while he is outside of the master’s premises, unless the servant is at the time using a chattel entrusted to him as servant.”); P.L. v. Aubert, 545 N.W.2d 666, 668 (Minn.1996) (holding employer not liable for employee’s intentional tort which was unforeseeable by the employer even though assault occurred “within work-related limits of time and place”).
Thus, where a plaintiff asserts a claim for negligent supervision, the question of whether the employer owes a duty of care to the injured third party boils down to issues of knowledge and causation — whether the employee’s acts are “so connected with *449the employment in time and place” such that the employer knows that harm may result from the employee’s conduct and that the employer is given the opportunity to control such conduct. Fowler V. Harper & Posey M. Kime, The Duty to Control the Conduct of Another, 43 Yale L.J. 886, 896 (1934); Fowler V. Harper et al., The Law of Torts § 18.7, at 738 (2nd ed.1986) (stating: “Thus a master may be bound to control acts of his servants that they do entirely on their own account but that are closely enough connected with the employment in time and space to give the master a special opportunity to control the servant’s conduct.”).
In Fletcher v. Baltimore & P.R. Co., the United States Supreme Court recognized instances where an employer may be liable in tort for permitting employees to engage in acts that may give rise to a claim for negligence. 168 U.S. 135, 18 S.Ct. 35, 42 L.Ed. 411 (1897). There, the Court held that the railroad company owed a duty of care to passersby when it allowed its employees to throw large pieces of wood from the train on their way home from a day’s work. Id. at 140, 18 S.Ct at 37. The Court recognized that throwing large pieces of wood from the train created a risk that people lawfully on the adjacent street would be harmed by one of those pieces of wood. Thus, a nexus existed between the employer’s knowledge of the employees’ activities and the risk of harm when a person was hit by one of those pieces of wood sufficient to allow a jury to determine whether the defendant negligently supervised its employees.
Similarly, this court in recognizing a claim for negligent supervision acknowledged a connection between the employer’s knowledge of the employee’s propensity to act in a particular manner and the employer’s duty to take reasonable steps to prevent the employee from acting in such a manner. The plaintiff in Destefano sued the Diocese of Colorado Springs for the negligent supervision of a priest who in the course of providing marriage counseling engaged in sexual relations with the plaintiff, Destefano. 763 P.2d at 279. Destefano alleged that the diocese knew or should have known that the priest had engaged in sexual relations with other women “similarly situated” to the plaintiff and that the diocese failed to take any action to limit his contact with potential clients. Id.. Thus, it was the connection between the very risk of harm that the diocese either knew or should have known would occur and the actual harm, sexual relations with a parishioner seeking counseling, which sustained Destefa-no’s claim for relief. Id. at 288.
In both of these eases, the duty imposed on the defendant was to take reasonable steps to prevent the foreseeable harm of a known risk — the person harmed was one who would likely be harmed by the known risk posed by the employee. The custom of permitting employees of the railroad company to throw wood from the train created a risk that they would damage property or harm someone near the tracks. Allowing the priest to continue to counsel clients created a risk that he would become sexually involved with those clients. In both cases, the very harm that the risk implied did indeed occur.3
*450The plaintiff did not present any evidence at trial' that Keller knew or should have known that Uzan would bring a twelve year-old girl, with no connection to the dry cleaners, to Keller’s place of business when it was closed and then sexually assault her there. However, there was substantial evidence that Keller knew of Uzan’s proclivities to engage in lewd and sexual behavior with the female employees on the premises during business hours. Three young women employees testified that they had quit after Uzan groped and fondled them. He also sexually propositioned these young women and made other sexually explicit statements. Testimony also established that Keller did not take any corrective action against Uzan except to confront him about the truth of the allegations after an employee’s mother warned of potential litigation. This proof supports a finding that Keller knew that Uzan’s continued employment created a risk that young women working at the dry' cleaners and potential customers would be subject to sexual contact and lewd behavior during business hours and Keller therefore had a duty to take reasonable steps to prevent that harm from occurring.
While Keller may have had a duty to take reasonable steps to protect women employees and customers from the known risk of harm that Uzan posed to these women during working hours, this known risk does not extend to the sexual assault suffered by Koca. She was neither an employee4 nor a customer. No evidence links Uzan to a sexual assault of a young girl at the business when it was closed and when he was supposed to be working alone. There was no evidence indicating that Keller knew or should have known that Uzan would bring a twelve year-old girl, the daughter of a friend, to his place of business during off-hours and sexually assault her there.5 Nor was there any evidence that it was reasonably foreseeable that an employee who created a sexually hostile work environment would then abuse his access to the premises and take a young girl with no connection to the business to that place of employment for the purposes of committing a sexual assault.
This case arguably presents a close question of whether the employer’s knowledge creates a duty to take reasonable steps to prevent a particular harm from occurring. But, in order for a duty of care to exist, there must be a connection between the employer’s knowledge of the employee’s dangerous propensities and the harm caused. This connection is crucial to decide whether an employer owes a duty of care.
Although Uzan posed a known risk of harm that he would subject women working at the cleaners and customers to lewd behavior and sexual contact, the necessary link to connect the employer’s knowledge of the risk posed by the employee and the harm that occurred does not exist. There is no evidence that Keller knew or should have known that Uzan’s proclivities created a risk of harm to a twelve year-old girl, with no connection to the business, who was then brought to the employer’s place of business, in violation of the employer’s rules, while the business was closed to the public, to sexually assault her. Therefore, we hold that Keller did not owe a duty of care to Koca under these circumstances.
Koca asserts that we should apply a more sweeping approach in determining whether the risk posed by Uzan imposed upon Keller a duty to prevent harm to her by essentially arguing that he owed a duty of care to all women and girls who came on the premises irrespective of whether Keller could anticipate their presence. This plaintiff has undoubtedly suffered great harm from the assault in this ease. However, we do not embrace a theory of negligent supervision that would be an open invitation to sue an employer for the intentional torts of *451an employee founded upon a generalized knowledge of that employee’s prior conduct. See Connes, 831 P.2d at 1321 (stating: “[W]e emphasize that an employer is not an insurer for violent acts committed by an employee against a third person.”).
Conclusion
For the reasons stated, we reverse the decision of the court of appeals and remand this case to that court to consider the plaintiff’s alternate theory of premises liability.
. We granted certiorari on the following issue:
Whether defendant, the owner of a dry cleaners, owed plaintiff, a family friend of the manager of the dry cleaners, a duty to prevent the manager from sexually assaulting plaintiff on a Sunday morning, when the establishment was closed for business, and defendant did not know the manager was bringing plaintiff to the establishment.
. The theory of negligent supervision is to be distinguished from vicarious liability where an employer may be liable for torts committed by an employee working within the scope of his employment. Pediatric Neurosurgery, P.C. v. Russell, 44 P.3d 1063, 1070 (Colo.2002); Grease Monkey Int’l, Inc. v. Montoya, 904 P.2d 468, 473 (Colo.1995); Hynes v. Donaldson, 155 Colo. 456, 395 P.2d 221 (1964); Lovejoy v. Denver & R.G.R. Co., 59 Colo. 222, 146 P. 263 (1915). Under the theory of vicarious liability, an employer may avoid liability if the employee commits an intentional tort because that act is generally not within the employee’s scope of employment. Moses, 863 P.2d at 329-30 n. 27, Cooley v. Eskridge, 125 Colo. 102, 114, 241 P.2d 851, 857 (Colo.1952).
. See also, HealthONE, 50 P.3d at 888-89 (risk that patient would be inadvertently injected with wrong medication if physician fails to discard unused medication after its administration); Moses, 863 P.2d at 329 (known risk that priest may develop sexual relation with parishioner receiving counseling created duty in diocese to take adequate steps to insure priest was not in position to conduct counseling); Greenberg, 845 P.2d 530 (medical test which is negligently selected creates risk that patient may suffer physical injury); Connes, 831 P.2d at 1323 (holding trucking company had duty to hire safe driver but had no reason to foresee that employee created risk that he would sexually assault or endanger member of public by engaging in violent conduct); Taco Bell, Inc., 744 P.2d 43 (evidence of ten armed robberies at defendant’s restaurant within three years established that risk of harm was foreseeable to customers from robbery and thus defendant had duty to take reasonable steps to protect patrons from criminal acts of unknown third persons who caused the harm to plaintiff in case); Bradley v. H.A. Manosh Corp., 157 Vt. 477, 601 A.2d 978 (1991) (holding that in claim for negligent supervision, evidence of prior convictions for driving while intoxicated and careless driving is relevant to knowledge of employee’s careless behavior when dealing with automobiles which caused plaintiff's harm); Int’l Distrib. Corp. v. American Dist. Tel. Co., 569 F.2d 136 (D.C.Cir.1977) (holding summary judgment inappropriate in claim for negligent supervision where employees of burglary alarm business stole from customers of the employer).
. Although Koca went with Uzan under the auspices that she would open the business for the carpet cleaner, it is not argued and no evidence was presented which suggests that Uzan had either the apparent or implied authority to bring her to the business.
. See e.g., Biel v. Alcott, 876 P.2d 60 (Colo.App.1993) (affirming dismissal of negligent supervision claim where no evidence was presented that employer knew of employee's misconduct in drinking wine on the job or whether employee had history of substance abuse) cert. denied (July 11, 1994).