C is correct. Most costs associated with an operational loss should be included, however, there are several categories of costs which should not be (such as opportunity costs) forgone revenue, and costs related to risk management and control enhancements implemented to prevent future operational losses.) Known legal costs incurred as a result of the loss should be included as part of the report. A is incorrect because costs of insurance are paid in advance. Insurance is purchased to protect the firm against potential operational losses but at the time insurance is purchased, the potentially insurable event (the hurricane) has not happened yet. Therefore, the insurance costs should not be included in the loss report. B is incorrect because the guidelines specifically prohibit provisions for opportunity costs, i.e., the cost of lost business due to the operational loss event. D is incorrect because "provisions should not include costs, such as retraining or relocating continuing staff" and should not include "costs related to risk management and control enhancements implemented to prevent future operational losses".