For months now, Chipotle Mexican Grill has been mired in a food safety crisis. Actually, the quick-service chain has struggled with six separate foodborne illness outbreaks: three strains of E. coli, two outbreaks of norovirus and one Salmonella contamination. A total of 514 people have been sickened at Chipotle locations across 14 states, and that is just the number who fell ill, went to a doctor, received testing and reported the results. Food safety experts believe that the true number of people affected is at least 10 times the reported figure in any outbreak.
Chipotle’s stock dropped approximately 40% in the wake of the outbreaks, leaving its value down about $6 billion at one point in late 2015. According to an SEC filing, sales at stores open more than a year were down 30% in December. For the entirety of the fourth quarter, sales were down by 14.6%, the first quarterly decline since the company went public in 2006, and executives announced that the quarter closed with a 44% decrease in profits. Founder and co-chief executive Steve Ells and his team admitted they could not guess how much the fallout will impact 2016 financial results, but expect it will be a “messy” year. The company may lose a number of suppliers central to its current business model, profits are down, and executives plan to spend some $50 million on the subsequent marketing campaign and new food safety measures that are being adopted.
It will likely take years for this crisis to fully subside, all the suits to be settled, and the true toll to be both measured and recouped. With more than $4 billion in annual revenue, Chipotle can probably take the heat. For smaller companies and suppliers in the food industry, however, even one outbreak could be fatal.
“For smaller suppliers or smaller producers, a recall can be devastating and could mean going out of business entirely, not just that you’re going to recover money from insurance in a couple of months,” said Michael McGaughey, partner in Lowenstein Sandler’s insurance recovery group. Unless a contamination is caught so early that the product has not even left the facility, McGaughey said companies will rarely if ever see a recall that costs less than $1 to $2 million, with most ranging from at least $5 million well into the teens.
For entities of every size, the Chipotle crisis clearly illustrates the many perils of supply chain failure, and some key lessons for managing the risks from farm to fork.
SUPPLY CHAIN SOURED
While food safety and product recalls are always a major concern in the food industry, the spate of infections poses even more of a threat to Chipotle as the company has built its reputation on the idea of a healthy, responsible supply chain, boasting its use of fresh produce, meat raised without antibiotics, and a network of hundreds of small, independent farmers. In the span of a summer, however, the company’s greatest strength suddenly became its greatest weakness as “food with integrity” turned into meals of uncertainty.
Although the outbreaks have ended, the wide variety of ingredients Chipotle uses makes tracking contaminated food far more difficult. Even with whole genome sequencing and other epidemiological evidence, both Chipotle and the Centers for Disease Control have been unable to identify the source of contamination in half of the outbreaks. As still-depressed sales attest, customers do not like being vulnerable to the unknown.
Given the chain’s nearly 2,000 locations and the rate at which it has expanded (about 200 new locations every year), its supply chain was already under pressure. Earlier this year, when an audit found unacceptable practices, the company suspended a primary pork supplier, pulling carnitas from the menu at about a third of its restaurants nationwide. The company pointed to its decisive action as proof of its commitment to sustainable agriculture, but many analysts said it highlighted the company’s inherent vulnerability to supply chain issues.
“They’re trying to be local and serve food with integrity, but as you grow it becomes incredibly complex and difficult and challenging,” Darren Tristano, executive vice president of industry research firm Technomic, told the Washington Post. “When you look at what’s going on, how they’re expanding, the outbreak was almost bound to happen.”
Other chains can also more easily meet food safety standards because components are centrally cooked, processed or frozen. The emphasis on local sourcing and fresh ingredients prepared in-house further increases the risks, as practices can vary more and when fresh vegetables are exposed to bacteria, it is difficult to wash the contamination away—cooking or freezing are the best ways to kill it.
Indeed, in the annual report released just months before the crisis began, the company admitted as much, warning that its use of “fresh produce and meats rather than frozen” and “reliance on employees cooking with traditional methods rather than automation” exposed the chain to a higher risk for outbreaks of foodborne illnesses.
Better controls can always help minimize the risk, and Chipotle has announced plans to implement more rigorous screening procedures, despite significant costs for the company and its suppliers. The company has hired a food safety testing and consulting company, IEH Laboratories and Consulting Group, to work with the supply chain and operations department on “a set of industry-leading practices.” Among the measures being adopted, the chain will begin preparing some components in centralized prep kitchens to attempt to increase control and monitoring of these ingredients, develop more rigorous in-restaurant preparation protocols, and conduct more frequent audits by both internal and third-party assessors.
The company will also put greater scrutiny on suppliers, requiring DNA-based testing of ingredients before they are shipped to restaurants. This program far exceeds regulatory requirements and industry standards—and has a price tag to match. Ells would not reveal the costs of the new testing requirements, but said neither customers nor suppliers will be paying to get the program started. Chipotle executives said they would consider raising prices to invest in food safety, but do not expect to do so before 2017, with CFO Jack Hartung calling the idea of immediate increases “tacky.” Although small farms will not be asked to cover the costs entirely—Chipotle is committing $10 million to help them meet the new standards—suppliers that are unwilling to meet the requirements will no longer do business with Chipotle.
That may mean some changes central to the brand’s identity in the name of its long-term viability. “We like the local program, we think it’s important, but with what’s just happened we have to make sure food safety is absolutely our highest priority,” Hartung told Bloomberg Businessweek. “If it’s testing and safety versus taking a step backward on local, we would do that and hope it would be temporary.”
“Fast-food companies are 100% reliant on their food supply to send them something that is pathogen-free, but the supply chain is still extremely reluctant to test every [food] product it provides,” food safety consultant Mansour Samadpour, president and CEO of IEH Laboratories, told the Washington Post. “Many companies are starting to do it, but the reluctance is real and it’s problematic—and that’s getting in the way of food safety.”
According to McGaughey, food producers should be paying more attention to their suppliers’ practices, and looking ahead during the contract-drafting process could help limit exposure. “A crisis like this just demonstrates the importance of vetting potential suppliers and making sure they adhere to proper safety procedures, and those can be set forth in contracts with the suppliers as to what procedures they should follow in order to ensure that the product reaches the ultimate consumer properly,” he said.
“Chipotle or any company that is going to take products—especially produce—and incorporate them into whatever product they’re selling, like a burrito, should be making sure their suppliers are adequately insured, that is with commercial general liability policies, third-party product recall policies, if possible, and that the limits of those policies are sufficient should a recall take place affecting your product.”
While crisis management measures are typically covered by insurers up-front, the costs of a recall mount quickly. “You’ve obviously lost not only whatever it cost to make the product but also profits from the sales value, and there are a lot of costs in terms of logistics like transportation and notifying customers and retailers,” McGaughey said. “Ultimately all of that has to be documented in a proof of loss that is submitted to the carrier within a year to two years, subject to policy terms, and adjusted. So from there, depending on the size of the recall, you could be looking at anywhere from six months to well over a year before you start getting some of the money back.”
LEGAL LEFTOVERS
At least nine lawsuits have been filed by customers sickened at Chipotle locations, and more are likely. Bill Marler, a food and safety litigator in Seattle, said that suits are coming from the 75 Chipotle-related clients he alone represents. Investors have also taken their anger to the courts, filing a class action that claims that the company made “materially false and misleading statements” about the company’s food safety controls in the wake of the outbreaks. The shareholders accuse Chipotle of failing to disclose that its “quality controls were inadequate to safeguard consumer and employee health” and allege that executives misled investors and the public about the severity of the outbreaks with a “reckless disregard for the truth.”
The latter charge is one with which federal prosecutors may come to agree. Chipotle disclosed in January that it was served a subpoena as part of a criminal probe by the U.S. Attorney’s Office and the Food and Drug Administration’s Office of Criminal Investigations regarding the Simi Valley norovirus outbreak in August. The outbreak was far larger than initially reported, and according to Food Safety News, while a sick employee is believed to have infected hundreds on Aug. 18, the company closed the location on Aug. 20, citing a “severe staffing shortage,” bleached all cooking and food handling surfaces, brought in replacement employees from other locations and served another 3,000 meals. Chipotle waited several days until 17 workers were sick before contacting health officials. In February, Chipotle disclosed that prosecutors had expanded their review to practices dating as far back as 2013.
Other companies should take note as the Department of Justice has clearly fired shots across the bow for the food industry, indicating it will adopt a new approach to taking food industry product safety more seriously and more aggressively pursuing individual wrongdoing on a criminal level. In a September memo to federal prosecutors nationwide, the DOJ announced a broad intention to focus more efforts on individual law-breakers in corporate crimes. While many saw the memo as a warning to the finance industry, the need for concern clearly applies across sectors. According to Andrew Lankler, partner at Baker Botts, the Department of Justice is signaling that whatever standard the food industry thought it needed to meet for food safety, the bar is higher. “The department is going to step up enforcement in areas where they can prove they sold tainted product,” he told the Wall Street Journal.
The same month the memo was released, the DOJ finalized the conviction of Stewart Parnell, former head of the Peanut Corporation of America, who was sentenced to 28 years in prison for knowingly shipping Salmonella-tainted products that sickened 714 people and killed nine. Federal prosecutors have increasingly targeted food industry producers for enforcement action, with cases related to beef, eggs and peanut butter all unveiled in 2014, and the PCA and Quality Egg cases resulting in criminal convictions in 2015.
“I think part of what we are seeing is the application of the broad principle that, as in many industries, the stronger the company’s brand, the higher the risk that they face, and that applies in terms across the board: civil claims, regulatory scrutiny and, increasingly, potential criminal inquiries and criminal liability,” said Syed Ahmad, an insurance partner at Hunton & Williams LLP.
If criminal charges are lodged against Chipotle executives, they would likely stem from failures in reporting and associated issues of prior knowledge of the contamination. As a result, the company’s insurers could in turn argue the chain’s actions—or lack thereof—negate or reduce coverage. While the success and extent of that argument would vary considerably based on the details of who knew what, when they knew, and what the insurance company was told, Ahmad said, prior knowledge would complicate insurance recovery, decreasing the payout or, at a minimum, driving up the cost of recovery in the struggle to reach an agreement.
“Often policies will have exclusions for known violation of criminal statutes and the like, so to the extent that is the kind of situation any of these companies is facing, they are probably going to have less access to insurance as a result,” he explained. “However, many of these policies would cover the attorneys’ fees, which can be significant, that arise out of any of these investigations before there’s been any finding of criminal liability, so I think there’s still a good potential to recover most of these expenses.”
For recalls and other food safety crises, Ahmad estimates that these fees are generally “easily in the tens of millions of dollars” due to class actions, civil claims filed across the country and the FDA’s regulatory review process. “Through some policies, insurance companies are going to be required to defend the policyholder, so the company itself will not be fronting any of the attorneys’ fees,” he added. “There are other kinds of policies where the company is required to pay for the difference and then seek reimbursement, though, so the policies in place and the terms will determine whether the company faces a cash-flow issue.”
While Chipotle can likely absorb the costs either way, this has proven to be a burden for other companies during recent recalls. The costs of the Blue Bell Creameries listeria recalls forced the company to lay off 1,450 of its 3,900-person workforce and furlough another 1,400. The third-largest ice cream company by nationwide sales, Blue Bell had not previously laid off employees in its 108-year history. Like Chipotle, the company is now the subject of a criminal investigation for its food safety violations, as the FDA found it had failed to tell health officials about repeated listeria findings in their plants for years.
REFRIED REPUTATION
“We know that Chipotle is as safe as it’s ever been before,” Ells asserted at a conference in January.
To convey that point to customers and staff alike, the company closed all of its stores for a few hours in early February to have a corporation-wide, virtual town-hall meeting with all 60,000 employees regarding regaining consumer trust and implementing food safety policies and protocols.
But customers remain extremely wary. Indeed, public opinion about the brand remains low, with YouGov’s BrandIndex score for the company seeing a drop equal to that of GM during its crisis.
This reputation hit is often the most enduring part of recovery from a food safety crisis. Indeed, McGaughey points to it as one of the main reasons to report suspected incidents to insurers as soon as possible. “Beyond assessing the situation internally and getting a hold of it for the safety of the public, notifying your insurer is the very first thing you need to do,” he said. “Crisis management and investigation all feed into each other, and insurers offer the resources to address them up front, so you want coverage to kick in as soon as possible to get the full benefit of the policy.” Expert epidemiological investigators and public relations expenses should be covered immediately, and insurance policies will outline what resources to call to get started.
Chipotle’s public relations team has already taken out full-page ads to apologize to customers in dozens of newspapers across the country. The chain also announced plans to launch a sizable new marketing campaign to win back customers, using direct mail and traditional advertising. As Fortune reported, executives said the campaign will attempt to provide a “detailed story of what happened” to explain to customers why they are now safe, and that it will not focus overtly on food safety, but will have “an undertone” of humility.
Ells claims the company “really had two events,” the E. coli outbreak in the Pacific Northwest and the norovirus outbreak in Boston. “Customers have conflated those two things and are somewhat confused about what happened,” he said.
But the average consumer is unlikely to make a distinction about what type of illness they may risk by dining at the chain—the stream of ailments dominating the news cycle for half a year is the real take-away. Regardless of where in the supply chain blame may really fall, the brand has the ultimate responsibility to its consumers and, in turn, the most to lose.
“From a public relations perspective, one of the worst things that can happen is to claim you’ve solved the problem, reintroduce a product, and have other people get sick—that’s why insurance companies provide expert investigation and remediation as part of the crisis management coverage,” McGaughey said. “Chipotle is different because they have a few different issues that unfortunately all happened at once. But I don’t know if Chipotle is really in a position at this point to try to point fingers about ultimate liability for products that pass through its stores.”
To its credit, though, the company appears to understand that reputation issue is not going away any time soon. As Mark Crumpacker, Chipotle’s chief creative and development officer, told Bloomberg, “This is not the kind of problem that you market your way out of.”