Chipotle’s Outbreak is Their Worst Risk Management Failure Yet: What Can They Do?

Steven Minsky | August 20, 2018

Since 2015, Chipotle has suffered multiple scandals of food-borne illness. The latest Chipotle outbreak has left more than 700 people ill. What does the Mexican grill have yet to learn?

Since 2015, Chipotle has suffered multiple scandals of food-borne illness. The latest Chipotle outbreak has left more than 700 people ill. What does the Mexican grill have yet to learn?

In my last blog, “Hey, Chipotle, Can You Say Risk Management Rehab?” I took a look at the company’s timeline, and more specifically asked the question as to whether changing their CEO structure twice in less than two years was really the answer to their spicy woes.

This latest Chipotle outbreak, which has been ongoing since July 26 at a location in Powell, OH, is proof enough the chain hasn’t uncovered the root cause of their repeated scandals.

Why Are People Still Getting Sick?

These outbreaks are likely to continue until Chipotle implements a robust enterprise risk management program. Let’s understand why:

CEO Steven Ells has commented multiple times on the recurring outbreaks with determination to make Chipotle “the safest restaurant to eat at.” So why can’t the restaurant get back on its feet?

I believe Chipotle has not realized this is a systemic risk management issue, as opposed to a smattering of one-off incidents to be addressed separately as if they have no commonality. This a classic whack-a-mole problem: each time a risk issue is “whacked, it only pops up again somewhere else.

To be sure, there has never been more than one outbreak at any one location. This is because, as soon as an outbreak occurs, the organization becomes hyper-focused on the incident.

For instance, after an outbreak in Sterling, VA in 2017, Ells cited a sick employee as the cause and announced the location’s employees would undergo “relentless training” on the company’s policies. Hyper-attention on one incident such as this is the wrong approach, as it only provides a band-aid solution, evidenced by the fact that hundreds of people are still falling ill.

The root cause of Chipotle’s outbreaks is not fallible sick policies or undercooked food, it’s ineffective risk management.

The 2015 Chipotle outbreaks occurred shortly after the restaurant launched an innovation to include locally sourced food in their recipes. A civil lawsuit filed in January 2016 alleged that the chain’s food-borne illness outbreaks were at least partially caused by the company’s decision to shift the process of prepping produce from central commissary kitchens to individual locations, which added about 1,000 points of food sourcing and contamination.

Innovation is great, but when risk assessments and mitigations are left out of the process, oversights and scandals are bound to occur. When new processes are created, or new policies are instituted, there needs to be a system in place to uncover the risks of new implementations and back-up plans for if these new processes fall short of excellence.

What Steps Can Chipotle Take to Stop the Outbreaks?

Whether the Chipotle outbreaks stem from incorrectly prepared ingredients, employees working while sick, or disparate food quality assurance practices, preventing future scandals means ensuring a common policy is followed across all locations.

All organizations, including Chipotle, can implement a risk-based approach to policy management and enterprise risk management by:

1. Identifying the stakeholders of a policy
2. Assessing the root-cause risks by engaging employees and contractors closest to the risks that threaten adherence to the policy across the organization
3. Addressing those risks with appropriate, centralized controls
4. Monitoring the effectiveness of those controls at each location with regularly-occurring tests and centralized reporting
5. Implementing proactive incident and complaint management for employees, customers, and vendors to report deviations from the policy both anonymously or by name
6. Repeating assessments regularly to proactively identify new emerging risks

With these steps, Chipotle can turn their attention away from band-aid, temporary fixes and focus on long-term, sustainable root-cause solutions. The customer-business relationship requires a lot of trust, as restaurants have a responsibility to their customers to protect them from harm. By implementing enterprise risk management across their locations, Chipotle will ensure a better tomorrow for their customers.