The retailer's coverage lawyer began by analyzing each of the three grounds cited in the denial letter, assessing the strength of each one independently, and determining which grounds could be challenged effectively and which, if any, had genuine merit.
The first and primary ground was the dishonesty exclusion. The policy excluded coverage for loss caused by or resulting from dishonest or criminal acts by the insured, any partner of the insured, or any person to whom the insured property is entrusted. The insurer's theory, as explained in the denial letter and as further developed during the coverage lawyer's follow-up inquiry, was that the theft was most likely committed by one of the two employees who had keys to the shop. The insurer reached this conclusion based on several observations: the shop had no security cameras, only three people had keys (the retailer and two employees), the forced entry at the rear door was described by the insurer's investigator as potentially staged, and the police investigation had not identified a suspect.
The coverage lawyer identified several weaknesses in this ground.
First, the burden of proof. In Canadian insurance law, when an insurer relies on an exclusion to deny a claim, the burden of proving that the exclusion applies rests on the insurer, not on the insured. The insured must prove that the loss falls within the insuring agreement, meaning that a covered event occurred. The insurer must prove that the exclusion removes coverage for that event. This is a critical distinction because it determines who must present the evidence. The retailer needed to prove that a theft occurred, which was straightforward: merchandise was missing, the police report documented a break-and-enter, and the forced rear door was consistent with an intrusion. The insurer needed to prove that the theft was committed by a person to whom the property was entrusted. The insurer had no direct evidence of employee involvement. No witness identified an employee as the perpetrator. No employee confessed. No stolen merchandise was found in any employee's possession. No employee exhibited suspicious behaviour before or after the theft. The insurer's theory was based entirely on inference: someone with keys could have committed the theft, and the forced entry could have been staged.