Item 1A. RISK FACTORS

You should carefully consider the risks described below in addition to the other information set forth in this Annual Report on Form 10-K, including the Management’s Discussion and Analysis of Financial Conditions and Results of Operations section and the consolidated financial statements and related notes. If any of the risks and uncertainties described below actually occur or continue to occur, our business, financial condition and results of operations, and the trading price of our common stock could be materially and adversely affected. The risks and uncertainties described below are those that we have identified as material but are not the only risks and uncertainties we face. Our business is also subject to general risks and uncertainties that affect many other companies, including, but not limited to, overall economic and industry conditions and additional risks not currently known to us or that we presently deem immaterial may arise or become material and may negatively impact our business, reputation, financial condition, results of operations or the trading price of our common stock.

Risks Related to our Business and Industry

Food safety and food-borne illness concerns may have an adverse effect on our business by decreasing sales and increasing costs.

Food safety is our top priority, and we dedicate substantial resources to ensuring that our guests enjoy safe, high-quality food products. Even with strong preventative controls and interventions, food safety incidents continue to occur in the food service industry because food safety risks cannot be completely eliminated in any restaurant, including as a result of possible failures by restaurant crew or suppliers to follow food safety policies and procedures. Although we test and audit these activities, we cannot guarantee that all food items are safely and properly maintained during transport or distribution throughout the supply chain. Regardless of the source or cause, any report of food-borne illnesses such as E. coli, hepatitis A, norovirus or salmonella, and other food safety issues, including food tampering or contamination, at one of our restaurants could adversely affect our reputation and have a negative impact on our sales. Even instances of food-borne illness, food tampering or food contamination that occur solely at competitors’ restaurants could result in negative publicity about the food service industry generally and adversely impact our sales. Social media has dramatically increased the rate at which negative publicity, including as it relates to food safety incidents, can be disseminated before there is any meaningful opportunity to respond or address an issue. The occurrence of food-borne illnesses or food safety issues could also adversely affect the price and availability of affected ingredients, resulting in higher costs and lower margins.

Several highly publicized food safety incidents in our restaurants and our Food With Integrity business principles may make us more susceptible than our competitors to significant adverse consequences arising from food safety incidents. From 2015 to 2017, illnesses caused by E. coli bacteria and norovirus were connected to a number of our restaurants and, in 2018, illnesses believed to be caused by c. perfringens bacteria were connected to the food in one of our restaurants. As a result of these incidents and the related negative publicity, our sales and profitability were severely impacted throughout 2016 and from time to time through 2018. Because of consumer perceptions in the wake of these food safety incidents, any future food safety incidents associated with our restaurants—even incidents that may be considered minor at other restaurants—may have a more significant negative impact on our sales and our ability to regain guests. In addition, we may be at a higher risk for food safety incidents than some competitors due to our greater use of fresh, unprocessed produce and meats, our reliance on employees cooking with traditional methods rather than automation, and our avoidance of frozen ingredients. The risk of illnesses associated with our food also may increase due to the growth of our delivery or catering businesses, in which our food is transported and/or served in transportation conditions that we cannot control. All of these factors could have an adverse impact on our ability to attract and retain guests, which could in turn have a material adverse effect on our growth and profitability.

Information technology system failures or interruptions could harm our ability to effectively operate our business and/or result in the loss of guests or employees.

We rely heavily on information technology systems, including the point-of-sale and payment processing system in our restaurants, technologies supporting our digital and delivery businesses, technologies that facilitate e-commerce, marketing programs, employee engagement and payroll processing, management of our supply chain, and various other processes and transactions. Our ability to effectively manage our business and coordinate the procurement, production, distribution and sale of our products depends significantly on the availability, reliability, security and capacity of these systems. Despite the implementation of protective measures, these technology systems and solutions could become vulnerable to damage, disability or failures due to theft, fire, power loss, telecommunications failure or other catastrophic events. We also are in the process of implementing a new enterprise resource planning (ERP) system, which will significantly impact our financial reporting control environment. If we fail to successfully implement the new system and effectively train our employees and update our processes, we could experience disruptions or delays in processing financial and business information. Our increasing reliance on systems operated by third parties, including delivery aggregators and payment processors, also present the risks faced by the third-party’s business, including the operational, security and credit risks of those parties. If those systems were to become unreliable, unavailable, compromised or otherwise fail, and we were unable to recover in a timely manner, we could experience an interruption in our operations that could have a material adverse impact on our profitability.

Cyber security breaches or other privacy or data security incidents that expose confidential guest, personal employee and other material, confidential information may adversely affect our business.

A cyber incident generally refers to any intentional attack or an unintentional event that results in unauthorized access to systems to disrupt operations, corrupt data or steal or expose confidential information or intellectual property. A cyber incident that compromises the information of our guests or employees could result in widespread negative publicity, damage to our reputation, a loss of guests, disruption of our business and legal liabilities. In recent years as our reliance on technology has increased, so have the scope and severity of risks posed to our systems from cyber threats. The techniques and sophistication used to conduct cyber-attacks and breaches of information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. We continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, malware and other events that could have a security impact; however there can be no assurance that these measures will be effective.

The majority of our restaurant sales are made by credit or debit cards. We also maintain certain personal information regarding our employees and confidential information about our guests and suppliers. We segment our card data environment and employ a cyber security protection program that is based on proven industry frameworks. This program includes but is not limited to cyber security techniques, tactics and procedures, including the deployment of a robust set of security controls, continuous monitoring and detection programs, network protections, vendor selection criteria, secure software development programs and ongoing employee training, awareness and incident response preparedness. In addition, we continuously scan our environment for any vulnerabilities, perform penetration testing, engage third parties to assess effectiveness of our security measures and collaborate with members of the cyber security community. However, there are no assurances that such programs will prevent or detect cyber security breaches.

From time to time we have been, and likely will continue to be, the target of cyber and other security threats. In April 2017, malware was detected in our payment processing network that was designed to access payment card data from cards used at point-of-sale devices at most of our restaurants. We removed the malware from our systems and enhanced our security measures; however, we incurred significant costs and legal liabilities in connection with this incident. See Note 13. “Commitments and Contingencies” to our financial statements for a description of this incident. Some of our guests also have experienced account takeover fraud, in which guests use the same log in credentials on multiple websites and, when a third party obtains those credentials, they can gain unauthorized access to their accounts and charge food orders to the credit card linked to the account (without accessing credit card data). We may in the future become subject to other legal proceedings for purportedly fraudulent transactions arising out of the actual or alleged theft of our consumers’ credit or debit card information or if consumer or employee information is obtained by unauthorized persons or used inappropriately. Any such claim or proceeding, or any adverse publicity resulting from such an event, may have a material adverse effect on our business and the potential of incurring significant remediation costs.

Security breaches also could result in a violation of applicable U.S. and international privacy and other laws, and subject us to private consumer, business partner, or securities litigation and governmental investigations and proceedings, any of which could result in our exposure to material civil or criminal liability. For example, the European Union adopted a regulation that became effective in May 2018, called the General Data Protection Regulation (“GDPR”), which requires companies to meet new requirements regarding the handling of personal data, including its use, protection and transfer and the ability of persons whose data is stored to correct or delete such data about themselves. Failure to meet the GDPR requirements could result in penalties of up to 4% of annual worldwide revenue. The GDPR also confers a private right of action on certain individuals and associations. Additionally, the California Privacy Act of 2018 (“CCPA”), which became effective on January 1, 2020, provides a new private right of action for data breaches and requires companies that process information on California residents to make new disclosures to consumers about their data collection, use and sharing practices and allow consumers to opt out of certain data sharing with third parties. If we fail, or are perceived to have failed, to properly respond to security breaches of our or third party’s information technology systems or fail to properly respond to consumer requests under the CCPA, we could experience reputational damage, adverse publicity, loss of consumer confidence, reduced sales and profits, complications in executing our growth initiatives and regulatory and legal risk, including criminal penalties or civil liabilities.

Compliance with the GDPR, the CCPA and other current and future applicable international and U.S. privacy, cybersecurity and related laws can be costly and time-consuming. We make significant investments in technology, third-party services and personnel to develop and implement systems and processes that are designed to anticipate cyber-attacks and to prevent or minimize breaches of our information technology systems or data loss, but these security measures cannot provide assurance that we will be successful in preventing such breaches or data loss. In addition, media or other reports of existing or perceived security vulnerabilities in our systems or those of our third-party business partners or service providers can also adversely impact our brand and reputation and materially impact our business, even if no breach has been attempted or has occurred.

The retail food industry in which we operate is highly competitive. If we are not able to compete successfully, our business, financial condition and results of operations would be adversely affected.

The retail food industry in which we operate is highly competitive with respect to taste, price, food quality and selection, customer service, brand reputation, digital engagement, advertising levels and promotional initiatives, and the location, attractiveness and maintenance of restaurants. We also compete with a number of non-traditional market participants, such as convenience stores, grocery stores, coffee shops and meal kit delivery services. Competition from delivery aggregators and other food delivery services has also increased in recent years, particularly in urbanized areas, and is expected to continue to increase. Increased competition could have an adverse effect on our sales, profitability and development plans. If consumer or dietary preferences change, if our marketing efforts are unsuccessful, or if our restaurants are unable to compete successfully with other retail food outlets, our business could be adversely affected.

We continue to believe that our commitment to higher-quality and responsibly sourced ingredients gives us a competitive advantage; however, more competitors have made claims related to the quality of their ingredients and lack of artificial flavors, colors and preservatives. The increasing use of these claims by competitors, regardless of the accuracy of such claims, may lessen our differentiation and make it more difficult for us to compete. If we are unable to continue to maintain our distinctiveness and compete effectively, our business, financial condition and results of operations would be adversely affected.

If we are not able to hire, train, reward and retain qualified restaurant crew and/or if we are not able to appropriately plan our workforce, our growth plan and profitability could be adversely affected.

We rely on our restaurant-level employees to consistently provide high-quality food and experiences to our guests. In addition, our ability to continue to open new restaurants depends on our ability to recruit, train and retain high-quality crew members to manage and work in our restaurants. Maintaining appropriate staffing in our existing restaurants and hiring and training staff for our new restaurants requires precise workforce planning. If we fail to appropriately plan our workforce, it could adversely impact guest satisfaction, operational efficiency and restaurant profitability. In addition, if we fail to adequately monitor and proactively respond to employee dissatisfaction, it could lead to poor guest satisfaction, higher turnover, litigation and unionization efforts. The low level of unemployment in the United States is resulting in aggressive competition for talent, wage inflation and pressure to improve benefits and workplace conditions to remain competitive. A shortage of quality candidates who meet legal citizenship or work authorization requirements, our failure to recruit and retain new restaurant crew members in a timely manner or higher employee turnover levels all could affect our ability to open new restaurants and grow sales at existing restaurants, and we may experience higher than projected labor costs.

Substantially all of our restaurants operate in leased properties subject to long-term leases. If we are unable to secure new leases on favorable terms, terminate unfavorable leases or renew or extend favorable leases, our profitability may suffer.

Substantially all of our restaurants operate in leased facilities. Locating and securing suitable lease facilities for new restaurants is becoming increasing challenging as competition for restaurant sites in our target markets is intense. Development and leasing costs are increasing, particularly for urban locations. These factors could negatively impact our ability to manage our occupancy costs, which may adversely impact our profitability. In addition, any of these factors may be exacerbated by economic factors, which may result in an increased demand for developers and contractors that could drive up our construction and leasing costs. Also, as we open and operate more restaurants, our rate of expansion relative to the size of our existing restaurant base will decline, making it increasingly difficult to achieve levels of sales and profitability growth that we achieved in prior years.

From time to time we close or relocate a restaurant as a result of adverse economic conditions in an area if a current location becomes less profitable. Because substantially all of our restaurants operate in leased facilities, we may incur significant lease termination expenses when we close or relocate a restaurant and are often obligated to continue rent and other lease related payments after restaurant closure. We also may incur significant asset impairment and other charges in connection with closures and relocations. If the lease termination cost is significant, we may decide to keep underperforming restaurants open. Ongoing lease obligations at closed or underperforming restaurant locations could decrease our results of operations. In addition, we may be unable to renew a lease or be unable to renew a lease without substantial additional cost at the end of the lease term and expiration of all renewal periods. As a result, we may be required to close or relocate a restaurant, which could subject us to construction and other costs and risks that may have an adverse effect on our operating performance.

If we are unable to meet our projections for new restaurant openings, or efficiently maintain the attractiveness of our existing restaurants, our profitability could suffer.

Our growth strategy depends on our ability to continue to open new restaurants and operate them profitably. Historically, it could take up to 24 months to ramp up a new restaurant, during which the restaurant generates sales and income below the levels at which we expect them to normalize and during which costs may be higher as we train new employees and adjust our food deliveries and preparation to sales trends. If we are unable to build the customer base that we expect or overcome the initial higher fixed costs associated with new restaurants, our new restaurants may not be as profitable as our existing restaurants. Our ability to open and profitably operate new restaurants also is subject to various risks, such as the identification and availability of economically viable locations, the negotiation of acceptable lease terms, the need to obtain all required governmental permits (including zoning approvals and liquor licenses) and to comply with other regulatory requirements, the availability of capable contractors and subcontractors, the ability to meet construction schedules and budgets, the ability to manage labor activities that could delay construction, increases in labor and building material costs, changes in weather or other acts of God that could result in construction delays and adversely affect the results of one or more restaurants for an indeterminate amount of time, our ability to hire and train qualified management personnel and general economic and business conditions. At each potential location, we compete with other restaurants and retail businesses for desirable development sites, construction contractors, management personnel, hourly employees and other resources. If we are unable to successfully manage these risks, we could face increased costs and lower than anticipated sales and earnings in future periods.

In addition, in an effort to increase same-restaurant sales and improve our operating performance, we continue to improve our existing restaurants through our remodels and upgrades. If the costs associated with remodels or upgrades are higher than anticipated, restaurants are closed for remodeled for longer periods than planned or remodeled restaurants do not perform as expected, we may not realize our projected desired return on investment, which could have a negative effect on our operating results.

Our inability or failure to recognize, respond to and effectively manage the accelerated impact of social media could have a material adverse impact on our business.

There has been a marked increase in the use of social media and similar platforms, including blogs, microblogs, video-sharing and messaging platforms and other forms of internet-based communications that allow immediate access to a broad audience. These platforms have dramatically increased the speed of dissemination and accessibility of information, including negative publicity related to food safety incidents and guest experience. Information, whether accurate or inaccurate, can be disseminated before there is any meaningful opportunity to respond or address an issue. The dissemination of information via social media could harm our business, prospects, financial condition, and results of operations, regardless of the information’s accuracy.

As part of our marketing efforts, we rely on social media platforms to attract and retain guests. New social media platforms are rapidly being developed, potentially making more traditional social media platforms obsolete. As a result, we need to continuously innovate and develop our social media strategies in order to maintain broad appeal with guests and brand relevance. We also continue to invest in other digital marketing initiatives that allow us to reach our guests across multiple digital channels and build their awareness of, engagement with, and loyalty to us. These initiatives may not be successful, resulting in expenses incurred without the benefit of higher revenues, increased employee engagement or brand recognition. Other risks associated with the use of social media include improper disclosure of proprietary information, negative comments about us, exposure of personally identifiable information, fraud, hoaxes or malicious dissemination of false information. The inappropriate use of social media by our guests or employees could increase our costs, lead to litigation or result in negative publicity that could damage our reputation.

Our failure to comply with various applicable federal and state employment and labor laws and regulations could have a material, adverse impact on our business.

Various federal and state employment and labor laws and regulations govern our relationships with our employees, and similar laws and regulations apply to our operations outside of the U.S. These laws and regulations relate to matters such as employment discrimination, wage and hour laws, requirements to provide meal and rest periods or other benefits, family leave mandates, requirements regarding working conditions and accommodations to certain employees, citizenship or work authorization and related requirements, insurance and workers’ compensation rules, healthcare laws, scheduling notification requirements and anti-discrimination and anti-harassment laws. Complying with these laws and regulations subjects us to substantial expense and non-compliance could expose us to significant liabilities. For example, a number of lawsuits have been filed against us alleging violations of federal and state laws regarding employee wages and payment of overtime, meal and rest breaks, employee classification, employee record-keeping and related practices with respect to our employees. We incur legal costs to defend, and we could suffer losses from, these and similar cases, and the amount of such losses or costs could be significant. In addition, several states and localities in which we operate, and the federal government have from time to time enacted minimum wage increases, changes to eligibility for overtime pay, paid sick leave and mandatory vacation accruals, and similar requirements. These changes have increased our labor costs and may have a further negative impact on our labor costs in the future.

In addition, several jurisdictions, including New York City have implemented Fair Workweek (or Secure Scheduling) legislation, which impose complex requirements related to scheduling for certain restaurant and retail employee and Sick Pay/Paid Time Off Legislation, which requires employers to provide paid time off to employees. Other jurisdictions where we operate are considering enacting similar legislation. All of these regulations impose additional obligations on us and could increase our costs of doing business. Our failure to comply with any of these laws and regulations could lead to higher employee turnover and negative publicity, and subject us to penalties and other legal liabilities, which could adversely affect our business and results of operations.

In addition, a significant number of our restaurant crew are paid at rates related to the applicable minimum wage. Federal, state and local proposals that increase minimum wage requirements or mandate other employee matters could, to the extent implemented, materially increase our labor and other costs. Several states in which we operate have approved minimum wage increases that are above the federal minimum. As more jurisdictions implement minimum wage increases, we expect our labor costs will continue to increase. Our ability to respond to minimum wage increases by increasing menu prices depends on willingness of our guests to pay the higher prices and our perceived value relative to competitors. Our distributors and suppliers could also be affected by higher minimum wage, benefit standards and compliance costs, which could result in higher costs for goods and services supplied to us.

Additionally, while our employees are not currently covered by any collective bargaining agreements, union organizers have engaged in efforts to organize our employees and those of other restaurant companies. If a significant portion of our employees were to become covered by collective bargaining agreements, our labor costs could increase, and it could negatively impact our culture and reduce our flexibility to attract and retain top performing employees.

Increase in ingredient and other operating costs could adversely affect our results of operations.

Our profitability depends in part on our ability to anticipate and react to changes in commodity costs, including ingredients, paper, supplies, fuel, utilities and distribution, and other operating costs, including leasing costs and labor. Any volatility in key commodity prices or fluctuation in labor costs could adversely affect our operating results by impacting restaurant profitability. The markets for some of the ingredients we use, such as beef, avocado and chicken, are particularly volatile due to factors such as seasonal shifts, climate conditions, industry demand, including as a result of animal disease outbreaks in other parts of the world, international commodity markets, food safety concerns, product recalls and government regulation. Increasing weather volatility or other long-term changes in global weather patterns, including any changes associated with global climate change, could have a significant impact on the price or availability of some of our ingredients. These factors are beyond our control and, in many instances, unpredictable. Volatility in prices or disruptions in supply also may result from governmental actions, such as changes in trade-related tariffs or controls, sanctions and counter sanctions, government-mandated closure of our suppliers’ operations, and asset seizures. The cost and disruption of responding to governmental investigations or inquiries, whether or not they have merit, or the impact of these other measures, may impact our results and could cause reputational or other harm.

We also could be adversely impacted by price increases specific to meats raised in accordance with our sustainability and animal welfare criteria, or other ingredients grown in accordance with our Food With Integrity specifications, the markets for which are generally smaller and more concentrated than the markets for conventionally raised or grown ingredients. Any increase in the prices of the ingredients most critical to our menu, such as chicken, beef, dairy (for cheese and sour cream), avocados, beans, rice, tomatoes and pork, would have a particularly adverse effect on our operating results. Alternatively, in the event the cost of one or more ingredients significantly increases, we may choose to temporarily suspend serving menu items, such as guacamole or one of our proteins, that use those ingredients rather than pay the increased cost. Any such changes to our available menu may negatively impact our restaurant traffic and could adversely impact our sales and brand. We can only partially address future price risk through forward contracts, careful planning and other activities, and therefore increases in commodity costs could have an adverse impact on our profitability.

Shortages or interruptions in the supply or delivery of ingredients could adversely affect our operating results.

Our business is dependent on frequent and consistent deliveries of ingredients that comply with our Food With Integrity specifications. Shortages, delays or interruptions in the supply of ingredients and other supplies to our restaurants may be caused by inclement weather, natural disasters, labor issues or other operational disruptions at our suppliers, distributors or transportation providers, or other conditions beyond our control. In addition, we have a single or a limited number of suppliers for some of our ingredients, including certain cuts of beef, tomatoes and adobo. Although we believe we have potential alternative suppliers and sufficient reserves of ingredients, shortages or interruptions in our supply of ingredients could adversely affect our financial results.

Our inability or failure to execute on a comprehensive business continuity plan following a major natural disaster such as a hurricane, earthquake or manmade disaster, including fire or terrorism, at our restaurant support centers could have a material adverse impact on our business.

Many of our corporate systems and processes and corporate support for our restaurant operations are centralized at one location. We have disaster recovery procedures and business continuity plans in place to address most events of a crisis nature, including hurricanes and other natural disasters, and back up and off-site locations for recovery of electronic and other forms of data and information. However, if we are unable to fully implement our disaster recovery plans, we may experience delays in recovery of data, inability to perform vital corporate functions, tardiness in required reporting and compliance, failures to adequately support field operations and other breakdowns in normal communication and operating procedures that could have a material adverse effect on our financial condition, results of operation and exposure to administrative and other legal claims. In addition, these threats are constantly evolving, which increases the difficulty of accurately and timely predicting, planning for and protecting against the threat. As a result, our disaster recovery procedures and business continuity plans security may not adequately address all threats we face or protect us from loss.

Our failure to effectively manage our growth could have a negative adverse effect on our business and financial results.

As of December 31, 2019, we operated 2,619 Chipotle restaurants and we plan to open a significant number of new restaurants in the next few years. Our existing restaurant management systems, back office technology systems and processes, financial and management controls, information systems and personnel may not be adequate to support our continued growth. To effectively manage our growth, we may need to upgrade, expand or enhance our infrastructure and information systems, as well as hire, train and retain restaurant crew and corporate support staff, which may result in increased costs or inefficiencies. We also place a lot of importance on our culture, which we believe has been an important contributor to our success. As we continue to grow, it may be increasingly difficult to maintain our culture. Our failure to effectively manage our growth could harm our business and operating results.

The increasing impact of and focus on sustainability and climate change could increase our costs, harm our reputation and adversely affect our financial results.

There has been increasing public focus by investors, environmental activists, the media and governmental and nongovernmental organizations on social and environmental sustainability matters, including packaging and waste, animal health and welfare, human rights, carbon footprints, deforestation and land use. In addition, we and our supply chain are subject to increased costs arising from the effects of climate change, greenhouse gases and diminishing energy and water resources. As a result, we have experienced increased pressure to make commitments relating to social and environmental sustainability, set science-based targets related to climate change and establish specific strategic initiatives relating to sustainability. If we are not effective in addressing social and environmental sustainability matters, or set and meet achievable sustainability goals, consumer trust in our brand may suffer. In addition, the costs to achieve our sustainability goals and the increased costs in our supply chain resulting from the impact of climate change, could have a material adverse effect on our business and financial condition.

**If w****e do not continue to persuade consumers of the benefits of paying higher prices for our higher-quality food, our sales and results of operations could be hurt.

Our success depends in large part on our ability to persuade consumers that food made with ingredients that were raised or grown in accordance with our Food With Integrity principles is worth paying a higher price at our restaurants relative to prices of some of our competitors, particularly quick-service restaurant competitors. Under our Food With Integrity principles, for example, animals must be responsibly raised, and the milk in our sour cream, cheese and queso must come from cows that have not been treated with rBGH, which practices typically are more costly than traditional farming. If we are not able to successfully persuade consumers that consuming food made consistent with our Food With Integrity principles is better for them and the environment, or if consumers are not willing to pay the prices we charge, our sales could be adversely affected, which would negatively impact our results of operations.

We could be party to litigation or other legal proceedings that could adversely affect our business, results of operations and reputation.

We have been and, in the future, could be subject to litigation and other legal proceedings that may adversely affect our business. These legal proceedings may involve claims brought by employees, guests, government agencies, suppliers, shareholders or others through private actions, class actions, administrative proceedings, regulatory actions or other litigation. These legal proceedings may involve allegations of illegal, unfair or inconsistent employment practices, including wage and hour, vacation and family leave laws, discrimination, and wrongful termination; food safety issues including poor food quality, food-borne illness, food contamination and adverse health effects from consumption of our food products; data security or privacy breaches; guest discrimination; personal injury in our restaurants; trademark infringement; violation of the federal securities laws or other concerns. For example, several lawsuits were filed against us in connection with malware that we detected in our payment processing network in 2017 alleging, among other things, that we negligently failed to provide adequate security to protect the payment card information of our customers; a number of lawsuits have been filed against us alleging violations of federal and state employment laws, including wage and hour claims; and we are the subject of an official criminal investigation being conducted by the U.S. Attorney’s Office for the Central District of California, in conjunction with the U.S. Food and Drug Administration’s Office of Criminal Investigations, related to company-wide food safety matters dating back to January 1, 2013. See Note 13. “Commitments and Contingencies” to our financial statements for a description of potential liabilities in connection with these matters. We could be involved in similar or even more significant litigation and legal proceedings in the future. Even if the allegations against us in current or future legal matters are unfounded or we ultimately are not held liable, the costs to defend ourselves may be significant and the litigation may subject us to substantial settlements, fines, penalties or judgments against us and may divert management's attention away from operating our business, all of which could negatively impact our financial condition and results of operations. Litigation also may generate negative publicity, regardless of whether the allegations are valid, or we ultimately are liable, which could damage our reputation, and adversely impact our sales and our relationship with our employees.

A failure to recruit, develop and retain effective leaders or the loss or shortage of personnel with key capacities and skills could impact our strategic growth plans and jeopardize our ability to meet our business performance expectations and growth targets.

Our ability to continue to grow our business depends substantially on the contributions and abilities of our executive leadership team and other key management personnel. Changes in senior management could expose us to significant changes in strategic direction and initiatives. A failure to maintain appropriate organizational capacity and capability to support our strategic initiatives or to build adequate bench strength with key skillsets required for seamless succession of leadership, could jeopardize our ability to meet our business performance expectations and growth targets. If we are unable to attract, develop, retain and incentivize sufficiently experienced and capable management personnel, our business and financial results may suffer.

Our digital business, which has become an increasing significant part of our business, is subject to risks.

In 2019, 18% of our revenue was derived from digital orders, which includes delivery and customer pickup. We have implemented technology, targeted advertising and promotions and remodeled our restaurants, including adding Chipotlanes, to accommodate the growth of our digital business. If we do not continue to grow our digital business, it may be difficult for us to achieve our planned sales growth. We rely on third-party delivery services to fulfill delivery orders, and the ordering and payment platforms used by these third-parties, or our mobile app or online ordering system, could be interrupted by technological failures, user errors, cyber-attacks or other factors, which could adversely impact sales through these channels and negatively impact our reputation. Additionally, our delivery partners are responsible for order fulfillment and errors or failures to make timely deliveries could cause guests to stop ordering from us. The third-party restaurant delivery business is intensely competitive, with a number of players competing for market share, online traffic capital, and delivery drivers. If the third-party delivery services that we utilize cease or curtail operations, increase their fees, or give greater priority or promotions on their platforms to our competitors, our delivery business and our sales may be negatively impacted.

General Business and Regulatory Risks

We are subject to extensive laws, government regulation, and other legal requirements and our failure to comply with existing or new laws and regulations could adversely affect our operational efficiencies, ability to attract and retain talent and results of operations.

Our business is subject to extensive federal, state, local and international laws and regulations, including those relating to:

preparation, sale and labeling of food, including regulations of the Food and Drug Administration, which oversees the safety of the entire food system, including inspections and mandatory food recalls, menu labeling and nutritional content;

employment practices and working conditions, including minimum wage rates, wage and hour practices, labor relations, paid and family leave, workplace safety, immigration, overtime, discrimination and harassment, among others;

health, sanitation, safety and fire standards and the sale of alcoholic beverages;

building and zoning requirements, including state and local licensing and regulation governing the design and operation of facilities and land use;

public accommodations and safety conditions, including the Americans with Disabilities Act and similar state laws that give civil rights protections to individuals with disabilities in the context of employment, public accommodations, and other areas;

environmental matters, such as animal health and welfare, climate change, the reduction of greenhouse gases, water consumption, the discharge, storage, handling, release, and disposal of hazardous or toxic substances, and local ordinances restricting the types of packaging we can use in our restaurants;

public company compliance, disclosure and governance matters, including accounting and tax regulations, SEC and NYSE disclosure requirements;

data privacy laws and standards for the protection of personal information, including social security numbers, financial information (including credit card numbers), and health information, and payment card industry standards and requirements.

Compliance with these laws and regulations, and future new laws or changes in these laws or regulations that impose additional requirements, can be costly. Any failure or perceived failure to comply with these laws or regulations could result in, among other things, revocation of required licenses, administrative enforcement actions, fines and civil and criminal liability.

Economic and business factors that are largely beyond our control may adversely affect consumer behavior and the results of our operations.

Restaurant dining generally is dependent upon consumer discretionary spending, which may be affected by general economic conditions that are largely beyond our control. For example, international, domestic and regional economic conditions, consumer income levels, financial market volatility, a slow or stagnant pace of economic growth, rising energy costs, rising interest rates, social unrest, and governmental, political and budget concerns may have a negative effect on consumer confidence and discretionary spending. Any significant decrease in our guest traffic or average transactions would negatively impact our financial performance. Any actual or perceived threat of a pandemic or communicable disease, terrorist attack, mass shooting, heightened security requirements, or a failure to protect information systems for critical infrastructure, such as the electrical grid and telecommunications systems, could harm our operations, the economy or consumer confidence generally. Any of the above factors or other unfavorable changes in business and economic conditions affecting our guests could increase our costs, reduce traffic in some or all of our restaurants or limit our ability to increase pricing, any of which could lower our profit margins and have a material adverse effect on our sales, financial condition and results of operations. These factors also could cause us to, among other things, reduce the number and frequency of new restaurant openings, close restaurants or delay remodeling of our existing restaurant locations. Further, poor economic conditions may force nearby businesses to shut down, which could reduce traffic to our restaurants or cause our restaurant locations to be less attractive.

Our quarterly results may fluctuate significantly, including due to factors that are not in our control.

Our quarterly results may fluctuate significantly and could fail to meet investors’ expectations for various reasons, including:

negative publicity about the safety of our food, employment-related issues, litigation or other issues involving our restaurants;

fluctuations in supply costs, particularly for our most significant ingredients, and our inability to offset the higher cost with price increases without adversely impacting guest traffic;

labor availability and wages of restaurant management and crew;

increases in marketing or promotional expenses;

the timing of new restaurant openings and related revenues and expenses, and the operating costs at newly opened restaurants;

the impact of inclement weather and natural disasters, such as freezes and droughts, which could decrease guest traffic and increase the costs of ingredients;

the amount and timing of stock-based compensation;

litigation, settlement costs and related legal expenses;

tax expenses, impairment charges and non-operating costs; and

variations in general economic conditions, including the impact of declining interest rates on our interest income.

As a result of any of these factors, results for any one quarter are not necessarily indicative of results to be expected for any other quarter or for any year. Average restaurant sales or comparable restaurant sales in any particular future period may decrease.

The market price of our common stock may be more volatile than the market price of our peers.

We believe the market price of our common stock generally has traded at a higher price-earnings ratio than stocks of most of our peer companies, which typically has reflected market expectations for higher future operating results. The trading market for our common stock has been volatile at times as well, including during the recent past as a result of adverse publicity events. As a result, if we fail to meet market expectations for our operating results in the future, any resulting decline in the price of our common stock could be significant.

Our anti-takeover provisions may delay or prevent a change in control of Chipotle, which could adversely affect the price of our common stock*.*

Our amended and restated certificate of incorporation and amended and restated bylaws contain some provisions that may make the acquisition of control of Chipotle without the approval of our Board of Directors more difficult, including provisions relating to the nomination, election and removal of directors, and limitations on actions by our shareholders. Delaware law also imposes some restrictions on mergers and other business combinations between Chipotle and any holder of 15% or more of our outstanding common stock. Any of these provisions may discourage a potential acquirer from proposing or completing a transaction that may have otherwise presented a premium to our shareholders, which could adversely affect the price of our common stock.