Chipotle's Indigestion

Business is constantly attempting to manage the risk-cost ratio through a mindset that asks, how little can they spend to avoid problems? What they almost always fail to calculate, as the following article explains about the decline in the once iconic Chipotle chain's reputation and business, is the cost of not investing enough. JL

Daniel Gross comments in strategy + business:

Just because you recognize a risk as a possibility doesn’t mean you can quantify how much it would cost to avoid it.
When a Chipotle restaurant opened in a strip mall in my town last summer, there were lines out the door. A signifier of urban sophistication had arrived in Fairfield County, Connecticut, no less important than the SoulCycle that opened in an adjacent storefront.
Several months later, however, our Chipotle is quiet as a library.
The burrito chain that roared from a single outpost in Denver to a nationwide phenomenon has suffered a brutal fall. The company’s stock, which rose 16-fold between January 2009 and the summer of 2015, has been scythed by 36 percent since mid-October 2015, vaporizing nearly $8 billion in market capitalization. The company projects that same-store sales in the first quarter of fiscal 2016 will fall between 8 and 11 percent compared with the same period a year ago.
The culprit wasn’t changing tastes, or a disruptive competitor, or a bad economy. Tex-Mex, burritos, and quick-service restaurants are as popular as ever. And the amount of money that Americans are spending at restaurants is rising sharply — up 8.1 percent in the first 11 months of 2015, compared with the first 11 months of 2014. Chipotle wasn’t done in by an external threat of any sort. Rather, it fell victim to a failure of internal controls. And it provides an object lesson on the nature of risk.
Simply put, Chipotle has suffered because, starting in October 2015, customers began to get sick after eating in the company’s restaurants. An outbreak of E. coli began on the West Coast, in Washington and Oregon, with more than a dozen people hospitalized. (The Centers for Disease Control has kept a running chronicle here, showing 53 people getting sick in nine different states, with 20 hospitalizations.)
Such violations are poison for any food-service organization. But they were particularly toxic for Chipotle, which has long billed itself as serving “food with integrity.” The company doesn’t stake its claim on customers’ palates by being the cheapest, or the fastest, or even the healthiest purveyor of lunch. Rather, Chipotle makes people feel good about their choices in part because of the choices it makes. The company doesn’t use genetically modified products, has run high-profile advertisements promoting the wholesomeness of its supply chain, and cooks food fresh in the restaurants. Chipotle’s burritos are calorie-rich comfort food.
But here’s the thing. While the outbreaks and their fallout seemed to catch everyone — investors, customers, and managers — by surprise, the risk was clearly there all along. In fact, the company said so in its most recent 10-K. The long list of “Risk Factors” runs 13 pages, and includes changes in food supply costs and the prospect that new store openings might cannibalize existing sales. Now, many of the risks companies disclose in these documents are boilerplate — they’re required by regulators, lawyers, and advisers. And many of them are generic. But Chipotle recognized and disclosed a particular risk:
“Instances of food-borne or localized illnesses could cause the temporary closure of some restaurants or result in negative publicity, thereby resulting in a decline in our sales, and could adversely affect the price and availability of the meat, produce, or dairy we use to prepare our food.”
Chipotle also acknowledged that it could face a higher risk of such issues than some other restaurants “due to our use of fresh produce and meats rather than frozen, and our reliance on employees cooking with traditional methods rather than automation.” It further told investors in no uncertain terms that food-borne illnesses could force the temporary closure of restaurants and reduce customer traffic.
Which is precisely what happened. The company voluntarily closed 43 restaurants in the Seattle and Portland areas in November 2015. The bad publicity caused traffic to dwindle throughout the country. And Chipotle has imposed new costs on itself as it tries to recover. When it reopened the temporarily shuttered restaurants later in November, the company announced it was “conducting additional deep cleaning and sanitization in all its restaurants nationwide,” “testing fresh produce, raw meat, and dairy items (cheese and sour cream) prior to restocking restaurants,” testing equipment, and “implementing additional safety procedures, and audits, in all of its 2,000 restaurants to ensure that robust food safety standards are in place.”
Companies can — and do — insure against many of the risks they face. A hurricane could destroy your building? Buy an insurance policy. Oil prices might spike? Hedge your exposure through financial contracts. But insulating a business the size of Chipotle from food-related issues might have been more daunting. Just because you recognize — and even disclose — a risk as a possibility doesn’t mean you can quantify how much it would cost to avoid it, how likely the danger is, and how damaging it could be should it materialize. A year ago, few analysts would have suggested that food-safety issues could pose an existential threat to Chipotle’s remarkable growth story.

Just because you recognize a risk as a possibility doesn’t mean you can quantify how much it would cost to avoid it. But what if someone had stood up at a leadership meeting and advocated that the company proactively embark upon the expensive laundry list of extra testing and cleaning efforts that Chipotle is now undertaking? One could imagine the objections: the return on investment is too hard to calculate, it would impair the ability to maintain profit margins, investors might get upset and sell shares. Besides, the company had managed its breakneck growth thus far without any such issues. History had provided abundant evidence that this particular risk was not one that had imposed any serious costs. And so the prospect of spending tens of millions of dollars on extra extensive monitoring, testing, and cleaning systems to ensure against the possibility of dangerous bacteria getting into any food would have seemed like purchasing an extra insurance policy on a risk that (a) hadn’t happened, and (b) was difficult to imagine.

In retrospect, of course, even $100 million in extra spending would have been a small price to pay if such efforts could have avoided the health issues that Chipotle has suffered. The return on that investment — in the avoided costs of having to repair a broken image and rebuild customer trust — would have been immense. But as they grapple with the need to engage in precautionary risk management, executives are fighting both inertia and human nature. Generals always fight the last war. And people often take out insurance against the loss they’ve just suffered. The sale of expensive backup generators always spike after a region suffers a lengthy power outage. Even in the burrito business, it is difficult to, um, wrap your mind around a risk that appears remote