Chipotle 2013 Annual Report Download - page 24

expense associated with these programs will adversely impact our financial results, and we may not generate the
levels of comparable restaurant sales we expect. In addition, our marketing has increasingly incorporated
elements intended to encourage customers to question sources or production methods commonly used to produce
food. These elements of our marketing could alienate food suppliers and other food industry groups and may
potentially lead to an increased risk of disputes or litigation if suppliers or other constituencies believe our
marketing is unfair or misleading. Increased costs in connection with any such issues, or any deterioration in our
relationships with existing suppliers, could adversely impact us or our reputation. Furthermore, if these messages
do not resonate with our customers or potential customers, the value of our brands may be eroded.
We have also implemented strategies such as remote ordering and catering options in an effort to increase
overall sales. Our catering program, in particular, is new and untested and may not increase our sales to the
degree we expect, or at all. Catering and other out-of-restaurant sales options also introduce new operating
procedures to our restaurants and we may not successfully execute these procedures, which could adversely
impact the customer experience in our restaurants and thereby harm our sales and customer perception of our
brand.
General Business Risks
We may be harmed by security risks we face in connection with our electronic processing and
transmission of confidential customer and employee information.
We accept electronic payment cards for payment in our restaurants. During 2013 approximately 64% of our
sales were attributable to credit and debit card transactions, and credit and debit card usage could continue to
increase. A number of retailers have experienced actual or potential security breaches in which credit and debit
card information may have been stolen, including a number of highly publicized incidents with well-known
retailers in late 2013 and early 2014. In August 2004, the merchant bank that processed our credit and debit card
transactions informed us that we may have been the victim of a possible theft of card data. As a result, we
recorded losses and related expenses totaling $4.3 million from 2004 through 2006.
We may in the future become subject to additional claims for purportedly fraudulent transactions arising out
of the actual or alleged theft of credit or debit card information, and we may also be subject to lawsuits or other
proceedings in the future relating to these types of incidents. Proceedings related to theft of credit or debit card
information may be brought by payment card providers, banks and credit unions that issue cards, cardholders
(either individually or as part of a class action lawsuit) and federal and state regulators. Any such proceedings
could distract our management from running our business and cause us to incur significant unplanned losses and
expenses. Consumer perception of our brand could also be negatively affected by these events, which could
further adversely affect our results and prospects.
We also are required to collect and maintain personal information about our employees, and we collect
information about customers as part of some of our marketing programs as well. The collection and use of such
information is regulated at the federal and state levels, and the regulatory environment related to information
security and privacy is increasingly demanding. At the same time, we are relying increasingly on cloud
computing and other technologies that result in third parties holding significant amounts of customer or
employee information on our behalf. If the security and information systems of ours or of outsourced third party
providers we use to store or process such information are compromised or if we or such third parties otherwise
fail to comply with these laws and regulations, we could face litigation and the imposition of penalties, which
could adversely affect our financial performance. Our reputation as a brand or as an employer could also be
adversely affected, which could impair our sales or ability to attract and keep qualified employees.
Our insurance coverage and self-insurance reserves may not cover future claims.
We maintain various insurance policies for employee health, worker’s compensation, general liability, property
damage and auto liability. We are self-insured for our employee health plans but have third party insurance
coverage to limit exposure for both individual and aggregate claim costs. We are also responsible for losses up to a
certain limit for worker’s compensation, general liability, property damage and auto liability insurance.
22
Annual Report