Chipotle 2012 Annual Report Download - page 23

General Business Risks
We may be harmed by security risks we face in connection with our electronic processing and
transmission of confidential customer and employee information.
We accept electronic payment cards for payment in our restaurants. During 2012 approximately 62% of our
sales were attributable to credit and debit card transactions, and credit and debit card usage could continue to
increase. A number of retailers, including us, have experienced actual or potential security breaches in which
credit and debit card information may have been stolen. In August 2004, the merchant bank that processed our
credit and debit card transactions informed us that we may have been the victim of a possible theft of card data.
As a result, we recorded losses and related expenses totaling $4.3 million from 2004 through 2006.
We may in the future become subject to additional claims for purportedly fraudulent transactions arising out
of the actual or alleged theft of credit or debit card information, and we may also be subject to lawsuits or other
proceedings in the future relating to these types of incidents. Proceedings related to theft of credit or debit card
information may be brought by payment card providers, banks and credit unions that issue cards, cardholders
(either individually or as part of a class action lawsuit) and federal and state regulators. Any such proceedings
could distract our management from running our business and cause us to incur significant unplanned losses and
expenses. Consumer perception of our brand could also be negatively affected by these events, which could
further adversely affect our results and prospects.
We also are required to collect and maintain personal information about our employees. The collection and
use of such information is regulated at the federal and state levels, and the regulatory environment related to
information security and privacy is increasingly demanding. If the security and information systems of ours or of
outsourced third party providers we use to store or process such information are compromised or if we or such
third parties otherwise fail to comply with these laws and regulations, we could face litigation and the imposition
of penalties, which could adversely affect our financial performance. Our reputation as a brand or as an employer
could also be adversely affected, which could impair our sales or ability to attract and keep qualified employees.
Our insurance coverage and self-insurance reserves may not cover future claims.
We maintain various insurance policies for employee health, worker’s compensation, general liability,
property damage and auto liability. We are self-insured for our health plans, and have purchased a fully-insured
stop loss policy to help offset our liability for both individual and aggregate claim costs. We are also responsible
for losses up to a certain limit for worker’s compensation, general liability, property damage and auto liability
insurance.
For policies under which we are responsible for losses, we record a liability that represents our estimated
cost of claims incurred and unpaid as of the balance sheet date. Our estimated liability is not discounted and is
based on a number of assumptions and factors, including historical trends, actuarial assumptions and economic
conditions, and is closely monitored and adjusted when warranted by changing circumstances. Our history of
claims experience is short and our significant growth rate could affect the accuracy of estimates based on
historical experience. If a greater amount of claims occurs compared to what we estimated, or if medical costs
increase beyond what we expected, our accrued liabilities might not be sufficient and we may be required to
record additional expense. Unanticipated changes may also produce materially different amounts of expense than
reported under these programs, which could adversely impact our results of operations.
We may not be able to adequately protect our intellectual property, which could harm the value of our
brands and adversely affect our business.
Our ability to successfully implement our business plan depends in part on our ability to further build brand
recognition using our trademarks, service marks, trade dress and other proprietary intellectual property, including
our name and logos, our Food With Integrity strategy and the unique ambience of our restaurants. If our efforts to
protect our intellectual property are inadequate, or if any third party misappropriates or infringes on our
intellectual property, either in print or on the internet, the value of our brands may be harmed, which could have
21
Annual Report