
924 N.E.2d 503 (2010)
Renae LAWSON, Plaintiff-Appellant,
v.
SCHMITT BOULDER HILL, INC., and McDonald's Corporation, Defendants-Appellees.
Nos. 2-09-0026, 2-09-0244.
Appellate Court of Illinois, Second District.
January 22, 2010.
*505 William B. Thompson, Hillsboro, TX, for Renae Lawson.
Patrick H. Norris, Law Offices of Lauren K. Meachum, Chicago, for McDonald's Corporation in No. 2-09-0026.
Hugh C. O'Donnell, Elaine C. Davenport, Sanchez, Daniels & Hoffman LLP, Chicago, for McDonald's Corporation, Schmitt Orchard LLC in No. 2-09-0244.
Justice BURKE delivered the opinion of the court:
Plaintiff, Renae Lawson, filed a two-count complaint in the circuit court of Kendall County against defendants, Schmitt Boulder Hill, Inc. (Schmitt),[1] and McDonald's Corporation (McDonald's). Plaintiff alleged that on December 18, 2005, she was a part-time employee at a restaurant owned by Schmitt and operated under a franchise agreement with McDonald's. She further alleged that just before 6 a.m. on that date she parked her car in the side area of the restaurant's parking lot. Before she was able to enter the restaurant she was robbed, abducted, and assaulted. She alleged that the attack and her resultant injuries were proximately *506 caused by defendants' negligence. McDonald's moved to dismiss under section 2-619(a)(9) of the Code of Civil Procedure (Code) (735 ILCS 5/2-619(a)(9) (West 2008)), arguing that it owed no duty to plaintiff. Schmitt moved to dismiss under the same provision, arguing that the exclusive remedy provision of the Workers' Compensation Act (820 ILCS 305/1 et seq. (West 2008)) barred plaintiff from suing Schmitt for negligence. The trial court entered separate orders, granting both motions to dismiss. Plaintiff timely filed separate notices of appeal from the two orders and we consolidated the appeals. We affirm the dismissal of plaintiff's claim against Schmitt, but we reverse the dismissal of the claim against McDonald's.
With respect to plaintiff's claim against McDonald's, her complaint includes the following pertinent allegations:
"04. At least since January 1, 2005 McDonalds [sic] has published standards for franchises [sic] such as Schmitt in the areas of lighting of the parking lots and procedures and disciplines [sic] for security of employees and patrons of Schmitt's restaurant[.]
05. McDonalds [sic] monitors and enforces compliance with said standards by dispatching McDonald's security persons to Schmidt [sic] on a regular basis during the year to confirm compliance with McDonald's said standards[.]"
In support of its motion to dismiss, McDonald's submitted an affidavit from one of its employees who averred that McDonald's did not own or operate the restaurant and had no right to control the restaurant's day-to-day operations or to hire, discharge, or discipline the restaurant's employees. The employee further averred that McDonald's did not pay utilities for the restaurant, did not "manufacture, process or prepare any product for sale" at the restaurant, did not supply any product to the restaurant, and did not file a tax return for the restaurant.
Plaintiff submitted a counteraffidavit averring that a representative of McDonald's visited the restaurant and spoke with the restaurant's managers "about compliance with the various rules and regulations which McDonald's requires its store franchises to follow and obey." According to plaintiff's affidavit, McDonald's issued a "Shift Manual" that described security requirements and made reference to an "O & T Manual" that plaintiff expected to obtain in discovery.
In response to a request to admit served by Schmitt, plaintiff admitted that on December 18, 2005, she was scheduled to start work at 6 a.m.
In case No. 2-09-0026, plaintiff argues that the trial court erred in granting McDonald's a dismissal under section 2-619(a)(9). Such a motion admits the legal sufficiency of the complaint, but asserts some affirmative matter as a defense. Corcoran-Hakala v. Dowd, 362 Ill.App.3d 523, 525, 298 Ill.Dec. 516, 840 N.E.2d 286 (2005). "The phrase `affirmative matter' refers to something in the nature of a defense that negates the cause of action completely or refutes crucial conclusions of law or conclusions of material fact contained in or inferred from the complaint." In re Estate of Schlenker, 209 Ill.2d 456, 461, 283 Ill.Dec. 707, 808 N.E.2d 995 (2004). More broadly, affirmative matters include "any defense other than a negation of the essential allegations of the plaintiffs' cause of action." Travis v. American Manufacturers Mutual Insurance Co., 335 Ill.App.3d 1171, 1174, 270 Ill.Dec. 128, 782 N.E.2d 322 (2002). Thus, although the defendant may challenge the plaintiff's legal conclusions, all well-pleaded facts and the inferences arising from those facts must be taken as true for purposes of a *507 motion under section 2-619(a)(9). In re Marriage of Diaz, 363 Ill.App.3d 1091, 1094, 301 Ill.Dec. 70, 845 N.E.2d 935 (2006).
Significantly, it is the defendant's burden to prove the affirmative matter defeating the plaintiff's claim. Daniels v. Union Pacific R.R. Co., 388 Ill.App.3d 850, 855, 328 Ill.Dec. 493, 904 N.E.2d 1003 (2009). The defendant bears the initial burden of presenting the affirmative matter (Reilly v. Wyeth, 377 Ill.App.3d 20, 36, 315 Ill.Dec. 428, 876 N.E.2d 740 (2007)), and unless the grounds for the motion appear on the face of the pleading being challenged, the motion must be supported by affidavit. 735 ILCS 5/2-619(a) (West 2008). If the defendant meets its burden, "the burden then shifts to the plaintiff to establish that the defense is `unfounded or requires the resolution of an essential element of material fact before it is proven.'" Reilly, 377 Ill.App.3d at 36, 315 Ill.Dec. 428, 876 N.E.2d 740, quoting Kedzie & 103rd Currency Exchange, Inc. v. Hodge, 156 Ill.2d 112, 116, 189 Ill.Dec. 31, 619 N.E.2d 732 (1993). Generally speaking, the trial court's decision is reviewed de novo. Solaia Technology, LLC v. Specialty Publishing Co., 221 Ill.2d 558, 579, 304 Ill.Dec. 369, 852 N.E.2d 825 (2006).[2]
Here plaintiff's complaint against McDonald's sounds in negligence. A complaint seeking recovery for negligence "must allege facts that establish the existence of a duty of care owed by the defendant to the plaintiff, a breach of that duty, and an injury proximately caused by that breach." Marshall v. Burger King Corp., 222 Ill.2d 422, 430, 305 Ill.Dec. 897, 856 N.E.2d 1048 (2006). The affirmative matter asserted by McDonald's to defeat plaintiff's claim is that McDonald's owed plaintiff no duty of care. The existence of a duty is a question of law, not of fact (Marshall, 222 Ill.2d at 430, 305 Ill.Dec. 897, 856 N.E.2d 1048), so it may be decided on a motion under section 2-619(a)(9) (see Lang v. Silva, 306 Ill.App.3d 960, 970, 240 Ill.Dec. 21, 715 N.E.2d 708 (1999); Wood v. Village of Grayslake, 229 Ill. App.3d 343, 349, 170 Ill.Dec. 590, 593 N.E.2d 132 (1992)). To meet its initial burden, McDonald's was obliged to show from the face of the complaint or by means of an affidavit that it owed no duty of care to plaintiff. If McDonald's met that burden, plaintiff would then be required to show that the "no duty" defense was unfounded or that proof of the defense would require resolution of an "`essential element of material fact.'" Reilly, 377 Ill. App.3d at 36, 315 Ill.Dec. 428, 876 N.E.2d 740, quoting Hodge, 156 Ill.2d at 116, 189 Ill.Dec. 31, 619 N.E.2d 732. However, for the reasons discussed below, we conclude that McDonald's failed to meet its initial burden. Accordingly, the trial court erred in granting its motion to dismiss.
On several occasions, courts have considered whether franchisors may be held liable in negligence for failing to exercise due care to protect their franchisees' workers from harm caused by the criminal acts of others. In Martin v. McDonald's Corp., 213 Ill.App.3d 487, 157 Ill.Dec. 609, 572 N.E.2d 1073 (1991), McDonald's appealed from a judgment entered following a trial. The plaintiffs were (1) two workers who were assaulted when a restaurant owned by a McDonald's franchisee was robbed and (2) the parents of another worker, who *508 was murdered during the robbery. McDonald's asserted, as it does now, that it had no duty to protect the workers, because they were employed not by McDonald's but by its franchisee. McDonald's contended that it had no special relationship with the victims that would give rise to a duty of care. The Martin court upheld the judgment, reasoning that McDonald's had voluntarily assumed a duty to the victims. The court noted that, although the law did not impose a duty on McDonald's to protect the employees of its franchisees from harm, McDonald's had recognized the threat of armed robberies and the importance of security in restaurants. McDonald's had formed a department or unit to deal with security problems and prepared a "bible" for restaurant security operations. McDonald's employed a regional security manager who served as the franchisee's security supervisor, and he "undertook not only the obligation to check for security problems, but also to communicate to the store management what the security policies were and to `follow-up' to be certain that the problems had been corrected and the `recommended' security procedures `followed.'" Martin, 213 Ill.App.3d at 491, 157 Ill.Dec. 609, 572 N.E.2d 1073.
Like Martin, Decker v. Domino's Pizza, Inc., 268 Ill.App.3d 521, 205 Ill.Dec. 959, 644 N.E.2d 515 (1994), was an appeal by the defendant from a judgment entered following a trial on the merits. In Decker, a worker at a store owned by one of the defendant's franchisees was seriously injured during a robbery. The court upheld the verdict under a voluntary-undertaking theory of liability because the defendant  the franchisor  formed a committee to study security issues, adopted a cash management system involving the use of time-delay safes in franchisees' stores, produced literature regarding robbery prevention, employed a franchise consultant to ensure compliance with the franchisor's standards (including robbery prevention) and to make sure that management trainees were properly trained in safety and security, and maintained a security hotline.
In contrast, in Castro v. Brown's Chicken & Pasta, Inc., 314 Ill.App.3d 542, 247 Ill.Dec. 321, 732 N.E.2d 37 (2000), the court affirmed a summary judgment in favor of the defendant on negligence claims. Those claims were filed by the administrators of the estates of two of the victims in a mass murder that occurred at a restaurant in Palatine that was owned and operated by one of the defendant's franchisees. The Castro court noted that deposition testimony by the defendant's employees established that security measures were left to the discretion of individual franchisees; the defendant did not mandate that any security procedures be followed, did not supply franchisees with any written materials concerning security issues, and did not employ security personnel for its franchisees. Castro, 314 Ill. App.3d at 550, 247 Ill.Dec. 321, 732 N.E.2d 37. Moreover, the record established that routine quality inspections conducted by the defendant were limited to matters of food safety and accident prevention; the inspections did not relate to crime prevention. Castro, 314 Ill.App.3d at 550, 247 Ill.Dec. 321, 732 N.E.2d 37. The Castro court carefully distinguished Martin and Decker, noting that unlike the defendants in those cases, the defendant in Castro "did not implement mandatory security measures to be followed by the franchisee, it did not follow up to make sure that security recommendations were followed, it did not provide security for the Palatine restaurant or engage in routine security checks, and it did not set up a security hotline or a committee to review security measures." Castro, 314 Ill. *509 App.3d at 552, 247 Ill.Dec. 321, 732 N.E.2d 37.
Similarly, in Chelkova v. Southland Corp., 331 Ill.App.3d 716, 265 Ill.Dec. 141, 771 N.E.2d 1100 (2002), the court affirmed summary judgment in favor of the defendant on the basis that it owed no duty to the plaintiff. The plaintiff, an employee at a convenience store owned and operated by one of the defendant's franchisees, was sexually assaulted while working alone at the store during a late-night shift. The record established that the defendant offered the services of field consultants to address security matters, prepared a robbery prevention kit, provided training to franchisees concerning rape and robbery prevention, and paid for a security system provided by an outside vendor. However, the record established that franchisees were not required to follow the defendant's recommendations and that the security system paid for by the defendant was optional. The Chelkova court distinguished Decker on the basis that the defendant in that case "took affirmative action to ensure compliance with its security standards," whereas the defendant in Chelkova permitted the franchisee to run the business as it saw fit. Chelkova, 331 Ill.App.3d at 724, 265 Ill.Dec. 141, 771 N.E.2d 1100. The Chelkova court found Martin to be distinguishable for similar reasons, noting that "McDonald's clearly undertook to implement and enforce security measures at the store in question." Chelkova, 331 Ill. App.3d at 725, 265 Ill.Dec. 141, 771 N.E.2d 1100.
Plaintiff's complaint specifically alleges that McDonald's "franchises its name, trademark, procedures and discipline on Schmitt," that McDonald's has "published standards for franchises * * * in the areas of lighting of the parking lots and procedures and disciplines [sic] for security of employees and patrons of Schmitt's restaurants," and that McDonald's "monitors and enforces compliance with said standards by dispatching McDonald's security persons to Schimdt [sic] on a regular basis during the year to confirm compliance with McDonald's said standards." These allegations, which must be taken as true for purposes of the motion to dismiss, establish that, unlike the defendants in Castro and Chelkova, McDonald's mandated compliance with security procedures. Martin, Decker, Castro, and Chelkova illustrate that whether a franchisor maintains mandatory security procedures is a crucial factor in determining whether the franchisor has voluntarily undertaken a duty of care toward a franchisee's employees. Given the procedural posture of the case, it is unnecessary to decide whether these allegations are sufficient in themselves to establish a duty. McDonald's had the initial burden to affirmatively show that, notwithstanding the well-pleaded allegations of plaintiff's complaint, it did not undertake a duty of care. McDonald's failed to meet that burden. Its affidavit indicates that it lacks authority to control the day-to-day operations of Schmitt's restaurant or to hire, discharge, or discipline Schmitt's employees, but none of the pertinent cases suggest that such authority is a prerequisite to the recognition of a duty. Other averments in the affidavit  e.g., that McDonald's supplies no products to Schmitt and does not file a tax return for Schmitt's restaurant  are even less to the point. Notably absent from the affidavit are any averments touching on the types of factors that were deemed significant in Martin and Decker. The affidavit does not indicate whether McDonald's produced a security "bible," whether it maintained any security committees, or whether any McDonald's employees served as security supervisors for its franchisees' operations.
Because McDonald's did not meet its initial burden of showing that it owed no *510 duty to plaintiff, the trial court erred in granting its motion to dismiss under section 2-619(a)(9).
In case No. 2-09-0244, plaintiff contends that section 5(a) of the Workers' Compensation Act (820 ILCS 305/5(a) (West 2008)) does not bar her from maintaining a civil action against her employer, Schmitt. Section 5(a) provides, in pertinent part, that "[n]o common law or statutory right to recover damages from the employer * * * for injury or death sustained by any employee while engaged in the line of his duty as such employee, other than the compensation herein provided, is available to any employee who is covered by the provisions of this Act." 820 ILCS 305/5(a) (West 2008). This provision "bars a common law action by an employee against an employer and his agents where the accidental injury (1) arose out of and (2) in the course of employment." Handzel v. Kane-Miller Corp., 244 Ill.App.3d 244, 246, 185 Ill.Dec. 72, 614 N.E.2d 206 (1993). "[I]njuries sustained on an employer's premises within a reasonable time before and after work are generally deemed to arise in the course of the employment." Caterpillar Tractor Co. v. Industrial Comm'n, 129 Ill.2d 52, 57, 133 Ill.Dec. 454, 541 N.E.2d 665 (1989). Plaintiff's injuries occurred in the course of her employment because she was abducted in her employer's parking lot shortly before beginning her shift. Accordingly, the dispositive question is whether her injuries "arose out of" plaintiff's employment.
Our supreme court has stated:
"For an injury to `arise out of' the employment its origin must be in some risk connected with, or incidental to, the employment so as to create a causal connection between the employment and the accidental injury. [Citations.] Typically, an injury arises out of one's employment if, at the time of the occurrence, the employee was performing acts he was instructed to perform by his employer, acts which he had a common law or statutory duty to perform, or acts which the employee might reasonably be expected to perform incident to his assigned duties. [Citation.]" Caterpillar Tractor Co., 129 Ill.2d at 58, 133 Ill.Dec. 454, 541 N.E.2d 665.
It has also been observed:
"When * * * an injury to an employee takes place in an area that is the usual route to the employer's premises, and the route is attendant with a special risk or hazard, the hazard becomes part of the employment. Special hazards or risks encountered as a result of using a usual access route satisfy the `arising out of' requirement of the Act." Litchfield Healthcare Center v. Industrial Comm'n, 349 Ill.App.3d 486, 491, 285 Ill.Dec. 581, 812 N.E.2d 401 (2004).
The claimant in Litchfield tripped on an uneven sidewalk while walking to her workplace  a residential health care facility  from the parking lot where it had been suggested that she park her car. The lot was also used by visitors to the facility. The Litchfield court concluded that the claimant's injuries arose out of her employment. Here, plaintiff alleges a lack of proper lighting and security in her employer's parking lot. Surely, this was as much a "special hazard" as the uneven sidewalk in Litchfield, and, pursuant to Litchfield, it became a hazard of her employment. As in Litchfield, it makes no difference that customers of Schmitt's restaurant might use the same parking lot and might face the same hazard. Plaintiff's employment exposed her to the hazard "to a degree beyond that to which the general public would be subjected." Litchfield, 349 Ill. App.3d at 491, 285 Ill.Dec. 581, 812 N.E.2d 401. Because plaintiff's alleged injury arose out of and in the course of her *511 employment, she may not bring a common-law action against her employer.
For the foregoing reasons, we affirm the order of the circuit court of Kendall County dismissing plaintiff's claim against Schmitt. We reverse the order of the circuit court of Kendall County dismissing plaintiff's claim against McDonald's, and we remand for further proceedings.
No. 2-09-0026, Reversed and remanded.
No. 2-09-0244, Affirmed.
BOWMAN and SCHOSTOK, JJ., concur.
NOTES
[1]  Schmitt is misnamed in the complaint as "Schmitt-Orchard LLC."
[2]  Where the plaintiff is not entitled to a jury trial, the trial court deciding a section 2-619 motion may, at its option, resolve factual disputes. If the court does so, its findings of fact will not be disturbed unless they are against the manifest weight of the evidence. A.F.P. Enterprises, Inc. v. Crescent Pork, Inc., 243 Ill.App.3d 905, 912-13, 183 Ill.Dec. 356, 611 N.E.2d 619 (1993).
