Chipotle Liability Risk Management Review

Ryan Fitzpatrick

Max Baumgartner

Table of Contents

Executive Summary............................................................................................................................. 3

Hazard Analysis.................................................................................................................................... 5

Loss Exposures.................................................................................................................................. 5

Graphic 1. Risk Management Strategy Matrix.....................................................................................6

Measuring and Analyzing Loss Exposures............................................................................................7

Techniques for Treating the Loss Exposures.......................................................................................7

Cyber Liability................................................................................................................................... 7

Current Strategies for Cyber Liability:...................................................................................................8

New Risk Management Strategies for Cyber Liability:....................................................................9

Products Liability.......................................................................................................................... 10

Current Strategies for Products Liability:..........................................................................................10

New Risk Management Strategies for Products Liability:...........................................................11

Summary and Professional Recommendations.......................................................................13

Appendix.............................................................................................................................................. 14

I. Public Relations Letter to Customers.................................................................................. 14

2

Executive SummaryThe purpose of this report is to conduct a risk management review of Chipotle’s loss

exposures and a hazard analysis of the major risks it faces. Our team provides risk management suggestions to senior management regarding the two major hazards outlined in this report.

The hazard analysis is a major component of this report. It includes detailed loss exposures, the proper measurement and analysis of the loss exposures, and techniques for treating the loss exposures. Risk reduction and risk transfer techniques are the best practices for perils that occur with a high severity and low frequency.

Based on the hazard analysis assessment, two major liability risks we identified are products liability class action lawsuits and cyber liability. Products liability class action lawsuits pose a large threat to Chipotle because it prides itself on serving customers “Food With Integrity.” One class action lawsuit with false allegations could have significant negative implications on the company in the media and marketplace. Chipotle has a large gap in coverage regarding cyber liability; therefore, our team has recommended the purchase of a cyber liability policy to help mitigate that risk.

Cyber liability insurance poses a noteworthy threat to the restaurant industry. Chipotle will transfer this risk to an insurance company in order to protect Chipotle’s private customer information, their rights, and our responsibilities. Chipotle will purchase insuring agreements that cover electronic data protection, cyber crime, notification or remediation, privacy liability, and electronic media liability. We strongly recommend purchasing a $5 million aggregate and $1 million per occurrence limit for cyber liability insurance.

Building a new warehouse facility in Colorado will eliminate the need for Chipotle to utilize a third party to warehouse data they are liable for. Chipotle uses cloud storage in the Internet to store customer data; building the warehouse in Colorado will ensure the customer’s personal information is safe and secure at all times. The system capacity will be large enough to store five years worth of data and will automatically recycle and purge data on the sixth year. An investment in IBM’s servers and warehouse enterprise system will provide Chipotle the capacity to use the system over the next 30 years.

Products liability class action lawsuits pose a significant threat to Chipotle’s cash flush business. Transferring this large risk to an insurance company and applying risk reduction techniques are the best business practices to implement. Chipotle should increase their policy limit and per occurrence limits on products liability and completed operations to $5 million and $2.5 million, respectively. This increase in coverage will ensure coverage several class action lawsuits are filed. A risk reduction technique that Chipotle will create is an emergency crisis management team to employ efficient and effective settlements while maintaining its loyal customer base.

Our team strongly encourages Chipotle’s senior management team to review our findings and consider implementing our recommendations provided in this report.

3

IntroductionThis document is an assessment of Chipotle’s potential risks and risk management

procedures that it is currently practicing. The following pages are engrossed with a detailed report on Chipotle’s liability exposures based on its 2014 loss history and recent news. The assessment of Chipotle’s risks is a critical way of solving any current and potential exposures it possesses. Furthermore, this review will highlight two major loss exposures that our team will address throughout the report.

Multiple reports have estimated that potential losses can be upwards of ten million dollars with the severity of the loss being even greater when using an estimated maximum loss prediction technique. Chipotle’s 2014 loss history provides claims in a variety of formats. Claims filed in 2014 include: auto, bodily injury, contractual, cyber, derivative suits, employment practices, environmental, products liability, property damage, and workplace bodily injury.

The two most significant exposures within the previous list are cyber liability and products liability class action lawsuits. We chose these two hazards based on an analysis of current exposures that not only affect Chipotle, but also have occurred in a multitude of other organizations within the same industry. An example of a significant potential products liability class action lawsuit is an occurrence that happened in 2009 where multiple food poisoning claims were filed based on over 400 customers becoming sick after eating the at a Chipotle in Minnesota. An example of a nationwide cyber liability attack occurred to Target within the last year. The company leaked personal information from over 40 million credit and debit cards, which occurred within a two-week span. Not only did Target divulge private customer information, but the hackers also gained access to social security and bank account numbers.

To fully assess the exposures of products liability class action lawsuits and cyber liability, we performed a hazard analysis of these two exposures and how they currently affect Chipotle. The hazard analysis first determined the potential loss exposures, then looked at comparable organizations risks, and recent lawsuits or general noteworthy news. The hazard analysis also provides new risk management strategies such as loss reduction and risk transfer techniques to be applied to Chipotle’s major hazard liabilities.

4

Hazard AnalysisThe liability risk management process contains a three-step process that consists of:

1. Identifying loss exposures 2. Measuring and analyzing loss exposures3. Techniques for treating loss exposures

Identifying loss exposures outlines current and future loss exposures that can potentially affect Chipotle. Once the loss exposures are identified, the hazard analysis goes on to further develop each exposure regarding how it currently affects the organization and what Chipotle can do to mitigate those exposures. Once the loss exposures are idenitifed and measured, new risk management strategies are developed to alleviate the burden of the highlighted exposures.

Loss Exposures

The loss history has demonstrated Chipotle has at least eleven significant possible loss exposures. The loss history suggests that within the last year, Chipotle faced the following liability risks:

Workplace bodily injury Bodily injury Auto Products liability class action

lawsuits Cyber liability (data breach,

invasion of privacy, credit and debit card theft/fraud)

Employment practices Contractual Property damage Derivative suits General bodily injury Environmental practices

Workplace bodily injury losses occur from employees receiving bodily injury from slips, falls, cuts, burns, and other kitchen hazards. The employees file worker’s compensation claims to seek indemnification.

Products liability class action lawsuits involve customers filing suit based on food poisoning, hospitalization from food, or other product related instances. Cyber liability contains a broader category of exposures since it contains events such as data breaches, invasion of privacy, and credit or debit card theft.

Employment practices exposures deal with claims of wrongful termination, sexual harassment, discrimination, breach of contract, and wage/hour law violations. Contractual liability is a similar exposure but focuses on the fiduciary responsibility Chipotle has with its clients.

Property damage is loss that occurs when property within the store or on designated Chipotle property is damaged. Derivative lawsuits consist of shareholder disputes on how the board of directors is operating Chipotle. General bodily injury

5

regards losses paid to customers if they receive bodily injury while on Chipotle property. Environmental liability suits occur with gross violations of government regulations that are mandated to preserve the environment.

Careful evaluation of the losses directed our team to focus on creating a solution for the severity of the products liability class action lawsuit claims and the severity of cyber liability claims. Both risks have the possibility for catastrophic losses, however our improved risk reduction techniques will enable Chipotle to continue growing its business without having the troublesome notion of not being prepared for cyber criminals or defective products lawsuits.

Cyber liability is a significant loss exposure due to the high severity of a data breach. Invasion of privacy or credit card theft could have severe financial implications and reputational damage for Chipotle. According to our online research, Target’s most recent breach of over 40 million customer’s credit cards has proven to have a significant impact on their P&L statement for the following year. According to Krebs Security, Target saw a Q4 2013 profit loss of 46% as a cause of the credit card breach. Customers lost trust in the company’s ability to handle their personal information and chose to shop elsewhere. Should the same credit card breach happen to Chipotle, the loss potential could be upwards of $20 Million. If a breach occurred, Chipotle would lose a significant amount of customers and credibility in the restaurant industry.

The significance of products liability class action lawsuits rests in the severity of claims that can occur within the policy period. Most claims filed for food poisoning happen because of heath code violations and poor food safety practices. The LexisNexis database shows at least five previous Chipotle food poisoning court cases with average settlements over $1 million. Settlements of this magnitude can aggregate to become significant amounts.

Graphic 1. Risk Management Strategy Matrix

Severity

Freq

uenc

y

High

Low High

Products Liabil-ity

Cyber Liabil-ity

I. II.

III. IV.

6

Measuring and Analyzing Loss Exposures

We created the scatterplot in Graphic 1 using the frequency and severity data from Chipotle’s 2014 loss history. To create the data, we took the average of the aggregate claims and created the scatterplot. Quadrant IV listed in Graphic 1, above, represents high severity but low frequency claims; perils in this quadrant require immediate attention as loss reduction and transfer strategies must be made in order to mitigate losses.

In order to plot the products liability and cyber liability points in the graph, our team collaboratively researched some recent losses. A comparison of a few restaurant class action lawsuits data proved, on average, products liability class action lawsuits paid out close to over $1.5 million in settlements. Our research further suggested that Chipotle had a significant data breach between 2004 and 2006 that resulted in an average loss of $2.15 million per year. These losses present a significant threat to Chipotle and the hazard analysis will review them in greater detail.

According to an insurance publication, in 2009, over 222 million records were leaked to the Internet. In 2013, over 614 million data breaches occurred. Based on this information and the data presented in Graphic 1, cyber liability poses a major threat to Chipotle and its customer’s security. In order to apply effective risk management techniques to mitigate the potential losses, risks that have high severity but low frequency should be transferred to insurance along with the application of loss reduction techniques. Our research and data suggests Chipotle could have loss exposures over $10 million if a breach were to occur.

Techniques for Treating the Loss Exposures

After scrutinizing the liability threats presented in Graphic 1, above, our team believes that the top two threats facing Chipotle are cyber liability and products liability class action lawsuits. Presented below is a detailed hazard analysis for the current risk financing and loss control strategies of each threat, as well as detailed suggestions and new management strategies.

Cyber Liability

Chipotle has a significant cyber liability exposure. Over 66% of Chipotle’s customers pay for their food via credit or debit card, this includes all of their personal and private information. When a customer hands a cashier their credit card to pay for their food, they do not reasonably assume their information is vulnerable to theft with a simple swipe. Customers are putting their trust into Chipotle’s IT systems when they pay with their card, therefore Chipotle is strictly liable if a hacker breaches their computer system and steals personal and private credit card information.

Data breaches can threaten customers’ privacy rights and companies can be held legally liable for invasion of their privacy. Customers instill their faith in the safekeeping of their personal information as they enter it on websites, place orders online, or swipe their credit or debit cards. Chipotle stores their customer’s data for marketing and analysis purposes; therefore, if a hacker steals a customer’s information during the course of a data

7

breach, chipotle will likely be held liable for negligence. The customer could argue Chipotle did not use a reasonable duty of care to protect the customer’s private information, and because they breached that duty, they can be held legally liable.

The customer’s identity is vulnerable in credit card transactions and the customer would suffer the most damages should a breach occur. Credit card information is sensitive because it can lead to credit card theft and identity theft. A customer’s financial stability can be destroyed if a cyber criminal obtains their social security number and other information. If a security breach occurs and Chipotle releases private customer information, Chipotle will likely be sued for customer privacy infringement.

If a breach occurs, Chipotle will face extreme amounts of negative publicity and damage to their reputation and brand. For example, when Target was breached and 40 million credit card numbers were released, their name made headlines for several weeks. According to TV by The Numbers, more than five million Americans watch Good Morning America (GMA) every day and listen to the latest news and crises. After Target saw weeks of headline news in GMA, the 2013 Q4 results stated Target posted a decline in profits of 46%. If Chipotle sees similar headline news, our team wants the company to have the best insurance coverage and risk reduction techniques in place to swiftly mitigate losses and ensure the highest customer retention.

Chipotle currently has a significant third party liability in the cloud. The cloud is a large data storage facility that allows a computer to communicate with other computers or devices within the specialized data storage area in the Internet. Chipotle has such a significant amount of data to store that they hire a third party warehouse to store their data for them. Chipotle recognizes they are legally liable if data gets stolen from the third party, however they currently do not have a better solution for storage. The cloud is not the most secure or best option for data storage; our risk management suggestions possess a unique solution to the data storage issue.

Current Strategies for Cyber Liability:

Risk Financing Strategies:

Chipotle does not have any risk financing for cyber liability. Currently the self-insured retention (SIR) limit is $5 million and last year’s loss run history did not exceed $3.3 million. Chipotle faced expenses of $4.3 million between 2004 and 2006 when a credit card merchant they used was infiltrated and potentially disbursed personal credit card information to the public. No litigation was found with the event.

Loss Control Strategies:

Speed and compassion go a long way with customer complaints. Since Chipotle’s social media presence has a large impact on its business and profitability, the organization has a team devoted to managing and monitoring their social media

8

presence. If a customer voices a complaint on twitter, they receive a speedy reply apologizing for the customer’s experience and ask them to voice their complaint via the “Talk to Us” tab on their website.

Segmentation and contracted third-party hackers keep the internal network safer than most companies. Segmentation is the distribution of data over several servers which means one track of data cannot be traced back to the previous. Segmentation is the equivalent of having 10 firewalls to get through in order to access data. The third-party hackers come to Chipotle’s headquarters once a month attempting to breach the system and see if there are any loopholes in the network protection.

New Risk Management Strategies for Cyber Liability:

Risk Financing Strategy:

Cyber liability insurance provides broad coverage for a wide array of perils. According to the International Risk Management Institute, cyber liability can provide coverage for business interruption, data loss/destruction, computer fraud, funds transfer loss, and cyber extortion. Costs incurred after the breach that are usually covered include: notification costs, credit monitoring expenses, defense costs, fines and penalties, and loss from identity theft. Cyber coverage should be purchased for any firm that conducts business electronically or stores data in any location. Chipotle has a gap in coverage with regards to cyber insurance that can be mitigated with the purchase of cyber liability insurance. Maintaining the $5 million SIR limit and utilizing those funds to pay for smaller claims and losses can reduce premiums. Our team recommends purchasing a cyber liability policy with a $5 million aggregate and $1 million per occurrence limit.

Cyber liability insurance includes roughly 11 common insuring agreements. Chipotle needs to select at least the following five insuring agreements to adequate cover their exposures:

Electronic data protection Cyber crime Notification or remediation Privacy liability Electronic media liability

Electronic data protection will serve good use when Chipotle’s computer servers are infected with a computer virus and data needs to be restored. Cyber crime coverage will provide security to Chipotle’s bank accounts, billing systems, and possible unauthorized transactions from foreign computers. When a loss involves Chipotle’s private customer information, the customers must be promptly notified and proper PR and crisis management techniques should be implemented; the notification or remediation insuring agreement will cover these potential losses. Privacy liability and electronic media liability insuring agreements should be added for security of customer information and Chipotle’s social media accounts.

9

The cloud will fail, and when it does, catastrophe will strike. The cloud consists of a collection of data servers as a data farm, which allows companies or consumers to purchase storage space in the cloud for information. Chipotle is aware they are liable should a loss occur from a hacker retrieving information from the cloud, therefore an alternate solution has been developed below.

A significant capital investment will enable Chipotle to build a data warehouse at a secure location in Colorado. Colorado has the typical climate to host a data warehouse; mild summers and cold winters enable servers to perform at their optimal performance without the need of significant utility costs for heating and cooling. Purchasing land in Colorado that is large enough for future development is a minor cost compared to the capital investment required for the data servers. The data servers will require an initial investment to purchase the servers, as well as maintenance costs and installation expenses. Our research suggests companies of similar size to Chipotle use a wide variety of IBM servers as they create reliable products at a reasonable price.

Products Liability

Products liability class action lawsuits pose a potential threat to Chipotle in excess of $10 million. Significant research and data proves that companies who face class action lawsuits pay out more than $1 million per settlement case. Class action lawsuits that make it to a jury trial have proven to dispense large monetary awards ranging anywhere from $1 million to $1 billion. McDonald’s coffee spill presented an exposure that totaled close to $3 million but was settled for around $600,000. Should Chipotle serve some of its customers with unsanitary food and their customers get food poisoning, the potential for a class action lawsuit to occur is tremendous.

The 2014 loss history states that Chipotle had 42 and 47 e-coli and food poisoning cases, respectively. Technology provides an easy way to connect with other constituents wishing to pursue legal action for their wrongs. Studies show in order for a class action lawsuit to have relevance, there must be more than 21 similar occurrences or losses from the same peril. Our loss history run provides the possibility that Chipotle could face a class action lawsuit in the near future.

Within the last year, Chipotle has seen a total of 482 products liability claims and can reasonably infer the same amount or more in the future; people in good health this year does not guarantee the same in the future. Even though there were 42 and 47 e-coli and food poisoning claims within the last year, respectively, those numbers do not pose a good means for comparison. E-coli cases are very specific since they infer that the food was contaminated before the customer consumed it, however food poisoning claims are more judgment based. Most companies choose to use goodwill efforts with case settlements to minimize the chances of a customer filing a lawsuit based on food poisoning.

For example, in order for a products liability class action lawsuit to occur from food poisoning, an employee could simply neglect to wash their hands after

10

going to the restroom and serve contaminated food for a few hours at lunchtime. Later that evening, if a local emergency room sees an influx of patients that require hospitalization due to food poisoning and they all ate Chipotle that afternoon, a class action lawsuit would likely be possible.

Current Strategies for Products Liability:

Risk Financing Strategy:

Chipotle currently has an SIR limit of $5 million with a $4 million products and completed operations sublimit; this insuring agreement also has a $1 million per occurrence limit. In 2014 the company experienced aggregate products liability losses at just over $1 million, which did not exhaust the SIR limit. Even though last years aggregate losses did not exceed the $5 million SIR limit, it can be reasonably inferred that with the growth Chipotle is experiencing they will face a greater amount of lawsuits and products liability claims. Chipotle is currently flush with cash so they attempt to retain as many losses as possible and transfer any potential excess risks to insurers. In comparison to other companies, Chipotle tends to exhibit a quick customer service response team to consumer complaints, therefore issuing small settlements efficiently and effectively.

Risk Control Strategies:

Chipotle’s best practices suggest that it currently has an emergency risk management plan in place and reaches out to customer complaints in a quick and efficient manner, thus mitigating the possibility of any class action lawsuits.

New Risk Management Strategies for Products Liability:

Risk Financing Strategy:

Our team recommends that Chipotle continue utilizing risk transfer techniques by transferring the risk to an insurance company, however increasing the policy limit would prove beneficial. We believe that continuing the $5 million SIR is the best practice for the amount of losses to retain since aggregate losses in 2014 totaled only $3.4 million. Increasing the products and completed operations limit from $4 million to $5 million would prove beneficial if Chipotle were to incur several products liability claims or class action lawsuits within the same policy period. Our team strongly recommends raising the per occurrence limit from $1 million to $2.5 million as this will better hedge Chipotle’s liability to the possibility of more than one loss occurring in a given year.

Keeping the current policy in place is suggested to be the best practice since insurance is purchased in the event that a fortuitous loss could occur. Our team has the viewpoint that accidents happen, sometimes more frequently than other. Our approach is more conservative as we analyze potential losses and worst-case scenarios.

Risk Control Strategy:

Chipotle needs to focus its attention on risk reduction strategies that will reduce the severity of the loss after it has already occurred. The system we are suggesting has the following parts:

11

A skilled emergency response team that is available 24/7 Prefabricated public relations press releases Open communication between upper, middle, and lower management Management that seeks counsel immediately after a large loss An investigation team that opens an internal investigation An information technology team that will post a banner on Chipotle’s website for

customers that have experienced losses in the class action suit

The goal of the skilled emergency response team is to be different than our competition. When Target experienced their credit card breach, they did not have an effective and efficient emergency response team readily available and stated multiple times that they hope to create better plans in the future. This team will preferably have experience in the restaurant industry regarding class action lawsuits and large volumes of clients to call. The speediness of our team will enable them to reach customers quickly with hopes to issue settlements and prevent their participation in the class action suit.

Appendix I demonstrates a prefabricated public relations press release. The appendix contains a prefabricated press release for a “norovirus” that could spread if an employee forgot to wash their hands before returning to work from the restroom.

Chipotle prides itself on word of mouth marketing. If upper management is aware that a class action lawsuit is imminent, however does not inform the lower levels of the organization, they can compromise Chipotle’s image and place its employees in difficult situations when speaking with customers. Effective communication during a crisis management plan is key; without it, failure is imminent. Employees preparing the food for customers are the face of the business. Therefore, if they are aware of the class action lawsuit, they can potentially refer the customer to Chipotle’s website and tell them to follow the link on the website. Essentially, this is reducing the severity of the lawsuit.

Several professional restaurant managers have mentioned that whenever the threat of a class action lawsuit is mentioned, senior management seeks counsel immediately. Time is a valuable asset that cannot be gained during crisis management, only lost. Adapting the mentality that someone who is specialized in a niche area such as class action lawsuits will know more about the precautionary steps necessary to take than an internal risk manager, could be the difference between protecting Chipotle’s image or headline news.

Opening an internal investigation of the trigger event demonstrates to the public that Chipotle takes products liability cases seriously. Some customers will likely not file claims and forget that they got sick if they believe Chipotle is making every effort to resolve the issue at hand. Class action lawsuits tend to occur when customers are seriously injured or perceive the company has not made a full effort to correct their wrongdoing.

12

Information technology has changed society to keep everyone updated with worldwide news. In the case that a norovirus spreads from a chipotle, see Appendix I, below, and a hundred people are hospitalized, there needs to be a way for the customers to reach out to Chipotle and have their voice heard. Once Chipotle is made aware that a class action lawsuit is imminent, the information technology team will place a banner along the top of the Chipotle website, enabling a customer who experienced damages from the incident to be heard. On the receiving end, someone from the 24-hour crisis management team will review their statement and determine if a settlement can be made. If a settlement is possible, the banner served its purpose by providing affected customers a quick avenue to reach out to corporate.

A general risk reduction technique that will reduce the severity of the loss once it has occurred is to issue undisclosed settlements and close court cases. Online research suggests that small class action lawsuits can be settled for around $1 million. An increase in the products and completed operations policy limit can accommodate for these settlements since our team also recommends increasing the per occurrence limit to $2.5 million.

Summary and Professional Recommendations This report assessed Chipotle’s major hazards and further developed risk management techniques for two of its largest perils based on high severity and low frequency claims. The data in this report directly correlates with the 2014 loss history and recent facts and data from database research.

The assessment included a hazard analysis that included three parts:

Loss exposures Analyzing and measuring loss exposures Techniques for treating loss exposures

Our findings suggest Chipotle needs to take a deeper look at their cyber and products liability class action lawsuit exposures. Both of these exposures are high severity but low frequency perils. When a loss occurs, the severity of the loss could be exponential if risk transfer and risk reduction techniques are not in place. We strongly recommend Chipotle implements the following risk management techniques within the next quarter and have them operational by Q4 2015.

We have a few key recommendations regarding cyber liability and products liability class action lawsuits. Cyber liability insurance needs to be purchased with the following insuring agreements: electronic data protection, cyber crime, notification or remediation, privacy liability, and electronic media liability. These insuring agreements will transfer the risk from Chipotle to the insurer and provide better protection regarding the customer’s private information. This policy protects Chipotle from large lawsuits arising from possible threats of negligence and theft of private information. We strongly suggest purchasing a $5 million aggregate and $1 million per occurrence limit for cyber liability insurance.

13

Products liability class action lawsuits pose a multi-million dollar threat to Chipotle on a regular basis. Chipotle’s pride and joy is their “Food With Integrity” that they serve. If a class action lawsuit arises from customers getting sick or a bacterial outbreak, Chipotle needs to be fully prepared with a crisis risk management team and emergency plan. This plan includes all of the following risk control techniques:

A skilled emergency response team that is available 24/7 Prefabricated public relations press releases Open communication between upper, middle, and lower management Management that seeks counsel immediately after a large loss An investigation team that opens an internal investigation immediately An information technology team that will post a banner on Chipotle’s website for

customers that have experienced losses in the class action suit

In addition to the risk control techniques, Chipotle will use best practices when trying to create settlements with its loyal customers. Chipotle should increase their policy limit and per occurrence limits on products liability and completed operations to $5 million and $2.5 million, respectively.

Appendix

I. Public Relations Letter to Customers

Issue has been identified and resolved

DENVER – Today Chipotle corporate confirmed it is aware of the food poisoning outbreak that occurred in Kent, Ohio and announces all victims of the outbreak will receive immediate compensation.

One hundred eighty students at Kent State University in Ohio were all victims of a sudden outbreak of a gastrointestinal illness that demanded hospitalization due to diarrhea, nausea and vomiting. After a short investigation was performed, it was concluded that all victims had eaten at a nearby Chipotle restaurant. Health officials stated the illness source came from a norovirus that contaminated the food. A norovirus is a virus that is a common cause of gastroenteritis in humans and can be easily transmitted by fecal contaminated food or water, and by person-to-person contact. Reports determine that a sick employee could have accidently contaminated the food via direct contact during the cooking process.

Presently, the Chipotle that was linked to the virus has disposed of all their food to prevent further illnesses from occurring. Additionally, the staff sanitized the entire restaurant.

Chipotle will be contacting all affected parties for recovery compensation by granting lines of credit to afflicted victims and potentially paying for medical expenses.

“Our focus has always been on using the kinds of higher-quality ingredients and cooking techniques used in high-end restaurants to make great food accessible at reasonable prices. Our vision has evolved. While using a variety of fresh ingredients remains the foundation of

14

our menu, we believe that "fresh is not enough, anymore." Now we want to know where all of our ingredients come from, so that we can be sure they are as flavorful as possible while understanding the environmental and societal impact of our business. We call this idea Food With Integrity, and it guides how we run our business.”

If any questions arise, please contact Maxwell Baumgartner at mjbaumg@chipotle.com or at 720-123-4567.

###

15