ORDER AND JUDGMENT *
CARLOS F. LUCERO, Circuit Judge.Plaintiff Julie Spencer was struck by a vehicle while walking through an Oklahoma Wal-Mart parking lot. Following the incident, she and her husband, Chris Spencer, individually and as next friends for their minor children, brought a negligence claim against Wal-Mart. They argue Wal-Mart breached its duty to protect Ms. Spencer from the criminal act of a third party occurring on its property. Concluding Wal-Mart owed no duty to Spencers under Oklahoma law because, on its fact-finding, Wal-Mart did not “know or have reason to know that a criminal act was occurring or about to occur,” the district court granted summary judgment in favor of Wal-Mart. We AFFIRM.
I
On October 3, 2001, Ms. Spencer and her husband went shopping at Wal-Mart Store No. 992, located in Tulsa, Oklahoma. Ms. Spencer and Mr. Spencer separated, with Ms. Spencer agreeing to meet her husband at their car after she finished browsing the garden department. When Ms. Spencer exited the store and approached her vehicle, a black, late-model sports ear rapidly accelerated towards her from the rear, swerved into her path, and struck her with sufficient force to hurl her into the air. The assailant then sped out of the parking lot. Although no Wal-Mart employee witnessed the incident, its security cameras recorded the attack.1 Police have been unable to identify a suspect based on the surveillance footage.
On October 4, 2002, Spencers filed a diversity action against Wal-Mart in federal court alleging state claims for negligence, gross negligence, willful disregard of duty, loss of consortium, and loss of parental consortium. Wal-Mart moved for summary judgment, and the district court granted its motion. Spencers now appeal that order.
II
Spencers’ Reply Brief was filed three days late, and Wal-Mart has moved to strike the brief as untimely. Conceding that the filing was untimely under Federal Rule of Appellate Procedure 31(a), Spencers ask us to excuse the delay because it was short-lived, Wal-Mart has not shown prejudice, and Spencers did not act in bad faith. We agree. Whether to excuse a late filing is within our discretion. See Burnham, v. Humphrey Hospitality Reit Trust, Inc., 403 F.3d 709, 712 (10th Cir. 2005). Absent an allegation by the opposing party that it suffered prejudice because of the delay, we generally allow such filings. See, e.g., id. (holding that party could file brief approximately two months late). Given the short delay and absence of prejudice, Wal-Mart’s motion to strike the reply brief is denied. We do, however, expect Spencers to comply with future deadlines.
*195hi
Spencers contend that the district court abused its discretion in granting summary judgment to Wal-Mart before ruling on their pending motion for leave to file an amended complaint. During a hearing on the summary judgment motion, the district court informed the parties it would defer ruling on Spencers’ motion to amend until after deciding Wal-Mart’s summary judgment motion. Following the hearing, however, the district court granted summary judgment in favor of Wal-Mart without ruling on Spencers’ request for amendment. Both parties consider this a denial of Spencers’ motion, as do we.
We review a district court’s denial of a motion to amend for abuse of discretion. Woolsey v. Marion Labs., Inc., 934 F.2d 1452, 1462 (10th Cir.1991). Federal Rule of Civil Procedure 15(a) provides that a party may amend its complaint “only by leave of court or by written consent of the adverse party.” Because Wal-Mart did not consent, Spencers were required to obtain leave from the court. “Although such leave shall be freely given when justice so requires, whether to grant such leave is within the discretion of the trial court.” First City Bank N.A. v. Air Capitol Aircraft Sales, Inc., 820 F.2d 1127, 1132 (10th Cir.1987) (internal citations and quotations omitted). Leave may properly be denied by the district court if it finds “undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the opposing party by virtue of allowance of the amendment, [or] futility of amendment.” Foman v. Davis, 371 U.S. 178, 182, 83 S.Ct. 227, 9 L.Ed.2d 222 (1962). Conversely, “outright refusal to grant [ ] leave without any justifying reason appearing for the denial is not an exercise of discretion; it is merely abuse of that discretion and inconsistent with the spirit of the Federal Rules.” Id.
Assuming it was error for the court below not to state “justifying reasons” for the implicit denial, this error is harmless if the “record contains an apparent reason [for] justifying the denial of a motion to amend” regardless of what the district court relied upon. Lambertsen v. Utah Dept, of Corr., 79 F.3d 1024, 1029 (10th Cir.1996). Based on our independent review of the record, we conclude that Spencers’ delay in filing a request to amend was unwarranted.
We recognize delay alone should not justify denial of leave to amend. Minter v. Prime Equip. Co., 451 F.3d 1196, 1205 (10th Cir.2006). In determining whether the delay was undue, we consider both the length of the delay and the reason for its occurrence. Id. at 1205-06. Here, the delay was substantial. Spencers filed their motion to amend seventeen months after filing their initial complaint and shortly before trial was scheduled to begin.
We fail to see a reason for the delay. Their claim for deceit and their assumption of duty theory of negligence,2 both based on Wal-Mart’s allegedly fraudulent *196representation that it was monitoring its video cameras, have been evident throughout the proceedings. Facts necessary to support these claims were known or should have been known to the Spencers at the time the original complaint was filed, and were clearly known to them at the time they filed their response to Wal-Mart’s summary judgment motion seven months before filing their motion to amend.3
We do not intend to impose upon plaintiffs a burden to immediately advance a claim upon notice of facts sufficient to support it. Litigants are allowed reasonable time to analyze information and make strategic decisions. Spencers have failed, however, to provide any legitimate justification for the substantial delay. As such, their motion to amend the complaint was undue, making the district court’s error in failing to address that motion harmless. See Evans v. McDonald’s Corporation, 936 F.2d 1087, 1091 (10th Cir.1991) (“[T]he liberalized pleading rules [do not] permit plaintiffs to wait until the last minute to ascertain and refine the theories on which they intend to build their case.”); Fed. Ins.
Co. v. Gates Learjet Corp., 823 F.2d 383, 387 (10th Cir.1987) (holding delay was undue when “the moving party was aware of the facts on which the amendment was based for some time prior to the filing of the motion to amend”).4
IV
Spencers’ final claim is that the district court erred in granting summary judgment to Wal-Mart on its negligence claim. We review the district court’s grant of summary judgment de novo, applying the same legal standard used by the district court. Signature Dev. Cos. v. Royal Ins. Co. of America, 230 F.3d 1215, 1218 (10th Cir.2000). Summary judgment is appropriate only when the evidence demonstrates that no genuine issue of material fact exists, and the moving party is entitled to judgment as a matter of law, viewing the evidence and making all reasonable inferences in favor of the non-moving party. Fed.R.Civ.P. 56(c); New York Life Ins. Co. v. K N Energy, Inc., 80 F.3d 405, 408-09 (10th Cir.1996).
*197Both parties agree that Oklahoma law governs this dispute. Under that law, a party seeking to establish negligence must prove: “(a) a duty owed by the defendant to the plaintiff to protect the plaintiff from injury, (b) a failure to properly exercise or perform that duty, and (c) plaintiffs injuries proximately caused by the defendant’s failure to exercise his duty of care.” Thompson v. Presbyterian Hosp., Inc., 652 P.2d 260, 263 (Okla.1982).
Of course, the threshold inquiry in a negligence action is whether a legal duty exists. Copeland v. Admiral Pest Control Co., 933 P.2d 937, 939 (Okla.Civ.App.1996). An invitor generally does not have a legal duty to protect invitees from criminal assaults by third parties. Davis v. Allied Supermarkets, Inc., 547 P.2d 963 (Okla. 1976). In Taylor v. Hynson, the Oklahoma Supreme Court carved out a narrow exception to this rule for “unique” or “exceptional” circumstances where an invitor “knows or has reason to know that the acts of the third person are occurring, or about to occur.” 856 P.2d 278, 281-82 (Okla. 1993) (citing Restatement (Second) of Torts §§ 344 cmt. f; 302A cmt. e (1965)).
Spencers present two theories why Wal-Mart owed a duty in this case. They first posit that Wal-Mart had a duty to protect Ms. Spencer from the criminal act of a third party because it knew prior criminal assaults had occurred on its parking lot and that implementing certain security measures would reduce the risk of future criminal assaults. Wal-Mart argues, and we agree, Oklahoma law imposes no duty upon it on these facts.
Comment f of the Restatement (Second) of Torts § 344 provides:
Duty to police premises. Since the possessor is not an insurer of the visitor’s safety, he is ordinarily under no duty to exercise any care until he knows or has reason to know that the acts of the third person are occurring or are about to occur. He may, however, know or have reason to know, from past experience, that there is a likelihood of conduct on the part of third persons in general which is likely to endanger the safety of the visitor, even though he has no reason to expect it on the part of any particular individual. If the place or character of his business, or his past experience, is such that he should reasonably anticipate careless or criminal conduct on the part of third persons, either generally or at some particular time, he may be under a duty to take precautions against it, and to provide a reasonably sufficient number of servants to afford a reasonable protection.
Some courts have imposed liability under comment f when a business owner is aware of prior criminal incidents and fails to take reasonable precautions to ensure customers’ safety. See, e.g., Becker v. Colonial Parking, Inc., 409 F.2d 1130, 1133-34 (D.C.Cir.1969) (applying Restatement (Second) of Torts § 344 and holding that a parking lot operator owed a duty to business invitees); Cunningham v. District of Columbia Sports & Entertainment Com’n, No. Civ.A. 03-839RWRJMF, 2005 WL 3276306, at *4 (D.D.C. Nov. 30, 2005) (applying Restatement (Second) of Torts § 344 and holding that concert host owed a duty to concertgoers to protect them from the intentionally harmful acts of third parties); Bethea v. Bristol Lodge Carp., No. CIV.A. 01-612, 2002 WL 31859434, at *9-10 (E.D.Pa. Dec. 18, 2002) (noting the Pennsylvania Supreme Court has cited comment f with approval and holding that plaintiff established a dispute of material fact as to whether adult dancing establishment knew or had reason to know of a third-party assault based on prior assaults committed at its premises and the character of its business); Kentucky Fried *198Chicken of Cal., Inc. v. Superior Court, 14 Cal.4th 814, 59 Cal.Rptr.2d 756, 927 P.2d 1260, 1265-66 (1997) (noting that the Restatement (Second,) of Torts § 344, including comment f, “continues to be the generally accepted test of liability of a business owner for injuries on the business premises caused by third party criminal conduct [in California]”). Spencers, however, expressly decline to argue that Oklahoma has adopted comment f, or that Wal-Mart owed a duty to the Spencers under comment f.
Instead, Spencers contend their case falls within Taylor’s exception which, they argue, announces the broad proposition that a landowner or business owner “knows or has reason to know” a criminal act is occurring or about to occur if: (1) it “knows or has reason to know” criminal acts have occurred on its property in the past and (2) certain security measures could stop future incidents. This interpretation would ignore the imminent danger essential to the Taylor exception. See Taylor, 856 P.2d at 281 (“When [a landowner] has knowledge that an invitee is in imminent danger, the [landowner] must act reasonably to prevent injury.”) (emphasis added).5 Oklahoma’s lower courts applying Taylor have consistently focused on whether the landowner knew or had reason to know the specific criminal act that caused the plaintiffs injury was occurring or about to occur.6 Spencers’ evidence establishes Wal-Mart should have had a general awareness that a criminal act would occur in the future, but it does not show Wal-Mart had knowledge of a specific criminal act that was about to occur.
Spencers rely heavily on McClure v. Group K Enterprises, 977 P.2d 1148 (Okla. Civ.App.1999). In McClure, plaintiff was struck in the head by a flying beer bottle while dancing at the Midnight Rodeo. She brought suit against the owner of the club, claiming it owed a duty to enact rules restricting patrons from bringing beer bottles onto the dance floor, and a jury ruled *199in her favor. At issue on appeal was whether a reasonable jury could find that defendant knew or should have known the beer bottle would have been thrown at plaintiff.
The court recognized the Taylor exception was limited to cases where a landowner “knows or has reason to know that the acts are occurring or about to occur.” It noted, however, that “where the negligent conduct creates a situation affording an opportunity for a third person to commit a tort or crime, the tort or crime is the superseding cause of the crime ‘unless the actor at the time of his negligent conduct realized or should have realized the likelihood that such a situation might be created, and that a third person might avail himself of the opportunity to create a tort or crime.’ ” Id. (citation omitted). Plaintiff introduced evidence the club was aware of similar incidents involving thrown bottles, continued to provide alcohol to patrons that posed an inherent risk of violence, and enacted policies it failed to follow prohibiting patrons from bringing bottles onto the dance floor in an effort to curb this violent activity. The court concluded a reasonable jury could find the defendant “created the danger” and thus should have known the incident was about to occur. Id. at 1151-52.7
McClure is distinguishable. First, unlike the dance club owner in McClure, Wal-Mart did not provide the assailant with the vehicle, nor did it impair the assailant’s judgment by offering an intoxicating substance. Second, no evidence is presented that Wal-Mart was aware of prior intentional hit-and-run assaults occurring in its parking lot, or that enacting certain security measures would reduce this particular type of crime. See Young v. Bob Howard Automotive, Inc., 52 P.3d 1045 (Okla.Civ.App.2002) (rejecting plaintiffs claim under McClure that landowner owed a duty based on prior criminal incidents because they failed to present evidence establishing the particular crime at issue — car thefts — had previously occurred on the property).
Spencers ask us to hold that, because Wal-Mart owns a business where crime has previously been committed, it owed a duty to enact security measures to prevent future crime. This theory was rejected by the Oklahoma Supreme Court in Davis and Taylor. See 547 P.2d at 964-65, 856 P.2d at 281.8
Spencers second theory is more on point with Taylor’s holding. Under this theory, Spencers allege Wal-Mart should have been aware that the vehicle was about to strike Ms. Spencer based on the following information, captured by WalMart’s security camera: (1) A black car entered Wal-Mart’s parking lot at approximately one p.m.; (2) During the four minutes prior to the attack, the vehicle did not pick up or drop off anyone and passed numerous open parking spaces; (3) The vehicle violated local traffic laws by traveling in the wrong direction down the traffic aisle providing the clearest path to the exit; (4) Approximately one minute passed between the time Ms. Spencer exited WalMart and the time she was hit by the vehicle; and (5) Approximately five sec*200onds elapsed between the time the car turned into the aisle where Ms. Spencer was walking and the time of collision.
Even assuming Wal-Mart had actual knowledge of the facts cited,9 this claim would fail because no reasonable jury could conclude a landowner should know a crime is about to occur under these circumstances. To hold Wal-Mart liable for the criminal act committed in its parking lot in this case would make it an insurer for virtually any criminal act that occurred in its parking lot, a theory of liability the Oklahoma Supreme Court has consistently rejected. Accordingly, we AFFIRM.
This order and judgment is not binding precedent, except under the doctrines of law of the case, res judicata, and collateral estoppel. This court generally disfavors the citation of orders and judgments; nevertheless, an order and judgment may be cited under the terms and conditions of 10th Cir. R. 36.3.
. At the time of the incident, Store No. 992 employed an eight-camera surveillance system which covered both the parking lot and rear of the premises. Each camera recorded a set area of the property, and footage was transmitted to a recording device inside the store. No employee was assigned to watch the security footage.
. Spencers proceed before us under the assumption that this theory of duty was asserted in the initial complaint, and the language they attempted to add to the complaint was solely for "clarification” purposes. Therefore, they claim on appeal the court erred in failing to address this theory in its summary judgment order. They are incorrect. Spencers first articulated this theory in their response to Wal-Mart’s motion for summary judgment, a point conceded by Spencers in their brief. Raising a claim in a response to a summary judgment motion does not properly present a claim to the district court for review, and accordingly the district court did not err in ignoring this claim in its order. See Maldonado v. City of Altus, 433 F.3d 1294, 1314 (10th Cir.2006).
. To prove deceit under Oklahoma law, a plaintiff must show: (1) defendant made a materially false representation; (2) defendant knew the representation was false; (3) defendant intended that the plaintiff should act upon that representation; (4) plaintiff relied upon that representation; and (5) plaintiff suffered injury. See Lee v. Bates, 130 P.3d 226, 230 n. 17 (Okla.2005). The original complaint alleged that Wal-Mart knew it was not monitoring its cameras, intended for people to rely on this representation, and Ms. Spencer was injured. Wal-Mart's intention to seduce customers into the dangerous parking lot, through its allegedly false claims of monitoring, was not mentioned in the complaint. It was, however, clearly stated in Spencers’ response to Wal-Mart's summary judgment motion filed seven months before their motion to amend the complaint, along with allegations of Ms. Spencers’ reliance on the representation. Spencers ambiguously argue these pieces of the deceit claim puzzle were not known until after the magistrate judge lifted a discovery order. They have failed, however, to identify any fact unknown to them until this time.
To prove a defendant voluntarily assumed a duty under Oklahoma law, a plaintiff must show that the defendant voluntarily undertook a duty to render a service, failed to exercise reasonable care in fulfilling that assumed duty, and caused the plaintiff's injury. Wark v. United States, 269 F.3d 1185, 1189 (10th Cir.2001). Because the facts supporting this claim are those used to support the deceit claim, our analysis above applies equally to this theory.
. Contrary to Spencers’ argument, we are not required to conclude that Wal-Mart suffered prejudice in order to hold there was undue delay. See First City Bank, N.A., 820 F.2d at 1133 (rejecting party’s argument that district court must find prejudice to deny a motion to amend on the grounds of undue delay).
. Spencers' misreading of Taylor comes into clear focus on consideration of the primary case on which Taylor relied, Davis v. Allied Supermarkets. In Davis, the Oklahoma Supreme Court rejected a plaintiffs’ argument that a supermarket should be liable for the acts of a purse snatcher on its property:
In all cases of purse snatching, it could be said that there were not enough guards. If there had been enough guards, the offense would not have occurred. This being true, to sustain the appellant’s position would for all practical purposes put the business owner in the position of an insurer. An insurer against what? Crime.
547 P.2d at 965.
. See Rogers v. Burger King Corp., 82 P.3d 116, 122-23 (Okla.Civ.App.2003) (rejecting plaintiff’s claim that Burger King owed a duty to protect him from the criminal acts of third parties based upon its remote location and its late hours of operation); Folmar v. Marriott, Inc., 918 P.2d 86, 89 (Okla.Civ.App. 1996) (affirming summary judgment in favor of defendant hotel on plaintiff’s negligence claim stemming from a third-party attack where two prior assaults had been committed on hotel property, because no evidence was presented that the hotel "had reason to know the acts of the assailants, in this case, were occurring or were about to occur, as required by [Oklahoma] Supreme Court precedent”); Edington v. A & P Enter., Inc., 900 P.2d 453, 455 (Okla.Civ.App.1994) (holding that a dispute over whether defendant's employees knew an assailant was about to commit a crime, based on employees' testimony that they were aware that the assailant was suspicious and "were concerned enough to 'watch the individual and [their] vehicles' ” precluded summary judgment on plaintiff's negligence claim) (alteration in original); Morgan v. Southland Assocs., 883 P.2d 205, 206 (Okla.Civ.App.1994) (holding plaintiff's factual allegations that mall security personnel were aware assailants had disturbed other mall patrons before attacking plaintiff, and possibly witnessed the attack, prevented dismissal of negligence claim against mall owner).
. The court also relied heavily on comment f of the Restatement (Second) of Torts, § 344. Spencers are not relying on comment f for purposes of this appeal.
. The only fact distinguishing this case from Davis and Taylor is that Wal-Mart conducted studies to determine procedures it could adopt to reduce crime at its stores. We refuse to hold, perversely, that a landowner who is aware of criminal acts on its property and does nothing is free from liability, but a landowner who acts to reduce the risk of crime is not.
. Drawing all inferences in favor of Spencers, these facts do not establish that Wal-Mart had actual knowledge of the vehicle’s activities. It is undisputed that no Wal-Mart employee observed the vehicle, either directly or by watching the security cameras as they recorded the incident. Spencers contend that information recorded by Wal-Mart’s security devices is imputed to Wal-Mart, but Wal-Mart is not obligated under Oklahoma law to implement security measures designed to protect its patrons from third party criminal activity, such as hiring a security guard to watch the cameras. See Taylor, 856 P.2d at 281. Further, we have not discovered any case holding that a landowner is deemed to know information captured by a recording device. See Rapid Transit Lines, Inc. v. Wichita Developers, Inc., 435 F.2d 850, 852 (10th Cir.1970) (holding that party's failure to cite relevant authority suggests that there is no authority to support the party's position).