Chipotle Mexican Grill, Inc. (CMG) Earnings Call Transcript & Summary

Good day and thanks for joining us. I'm Bob Bragdon, Senior Vice President and Worldwide Managing Director of CSO. Organizations of all shapes and sizes have unique stories of resilience to tell about their experience responding to the pandemic, lessons of reach beyond just pandemic response and speak to the resiliency of their businesses. Today, we're speaking with Dave Estlick, the Chief Information Security Officer of Chipotle Mexican Grill. Founded in Colorado in 1993, Chipotle has over 85,000 employees and more than 2,600 restaurants in the U.S., Canada, U.K., France and Germany. Before joining Chipotle last December, Dave was a CISO of Starbucks for nearly a decade, and prior to that, held senior security roles at PetSmart and Amazon. Dave was also a 2020 inductee of the CSO's Hall of Fame. Dave, welcome, and thanks for sitting down with us today.

Thank you, Bob. Pleasure to be here.

Maybe I could ask you to begin by taking us through your Chipotle's pandemic experience.

Yes. I mean I think for COVID-19 and -- there are two high-level lessons that I think that were highlighted at Chipotle and kind of applied to the broader landscape. One is how your organization has dealt with prior crisis. So Chipotle was in a position where they had not only gone through tabletop exercises but had issues that they needed to work through over the past several years. And as a result of that, had instituted processes and procedures throughout the organization focused on health and wellness. So as we were hit with this particular crisis, we were well positioned already from a process and procedure standpoint at our restaurants for checking employee health before they came in on the use of antibacterials. So from an industry sector perspective, many of our competitors and peers have had to figure out how to address those under this particular crisis, where that was some problem that was already solved. So I think the experiences in the past and how your organization dealt with those was key. And secondly in this one, specifically, was how your organization was positioned from a digital transformation perspective. So how much -- how far along on that journey were you? And I think the companies that had begun making those investments a few years earlier found themselves much -- in a much better place to respond and adapt to the changing environment as opposed to those that maybe were early in the journey or it was a future plan.

Yes. Yes. Let's follow with that thread a little bit. Every business' experience of COVID-19 has been different. But how have you seen an organization's progress towards digital transformation affect their ability to respond? And what does that mean for them long term?

Yes. So -- I mean this really was a defining moment, a divining moment, if you will, for organizations. Those that were further along could very quickly adapt to the changing environment, the changing workplace and what they had to -- it allowed them to focus less inwardly from a technology perspective and more about how are they going to support the business because there were changes unilaterally throughout the enterprise. Those that were further behind now had to figure out how to accelerate programs that maybe were in early stages or hadn't even begun planning yet. So I think the former group, this was maybe more of a springboard effect. The latter group, this is really an anchor around the organization.

Where are you seeing weak spots to be in an organization's resiliency plans when it came to the pandemic in this case?

Yes. I think most organizations had a business continuity, disaster recovery and crisis plan. I think what this highlighted was in several organizations that wasn't holistic enough. So the plan really focused on the experiences of the past, which were more around either geopolitical and social unrest or acts of God, weather. And so it was focused on losing a field office or a center of operations or a data center, it wasn't losing everything holistically all at once. So I think what we saw internally is strained capacity which leads to the second part of it, on your suppliers, vendors and third parties that you rely upon. How well were they positioned to be able to address this as well. So even the video conferencing vendors, they were strained at capacity because all of a sudden, organizations moved to whatever they were operating on, whether it was Microsoft Teams or Cisco Webex or Zoom. All of a sudden, they got a burst in demand and how well were they positioned to be able to adapt to that.

Well, let's talk for a minute about what you call the resiliency of Tier 0 services. Our organizations have spent years consolidating providers then as few as possible in an effort to, I guess, bring financial benefits at a lot of the supply chain. How does that affect business' response to the pandemic?

Well, I think that needs to be rethought a bit, especially in large-scale or black swan events like COVID-19. If you're highly reliant on a third party, let's say, it's for VPN connectivity, and they're unable to scale with your demand, what's your option, right? Wait until they fix and address their problems so your business can get -- become operational again? Or are you really looking at maybe in certain circumstances, depending on the criticality of the service, that we actually do have a second vendor in the mix that allows us to burst that capacity when needed. So I know it's one of the items for consideration for my organization. We'll go back and reevaluate that on the services where we saw either degraded performance or were slow to respond. Are we going to work with the single source vendor to try to ensure that we have that capacity when our business needs it? Or are we going -- and it's probably more of an, and we'll look for probably a secondary or tertiary vendor to, say, if we need to scale quickly and widely, we have the ability to do so.

Do you spread that out? I mean like not being in the pandemic right now, but just assuming that. Do you spread that out and say, I'm going to use 2 or 3 vendors, and I'm going to do -- everyone's going to get half the business. So each one is going to get 1/3 of our business. Or do you say, I'm going all-in with one, and I keep this guy and retain them over here just in case I need them?

So typically -- it's interesting because in the retail space, this is no different than payment providers. And what I've seen work in the past is there usually is a lead organization, and you will essentially -- they're going to push for exclusivity, right? They're going to watch all the business. And you say no, but the top vendor will get 90% of the traffic, guaranteed, right. 10% will fall to a secondary vendor. However, if the primary vendor has a problem, we're going to swing old traffic until that's resolved to the secondary vendor. That provides the ability -- the resiliency that you need for that critical service to your business as well as the ability for burst capacity. The added benefit is in contract renegotiation. When that comes back up, those 2 vendors are now vying for the 10%, 90%, where when you're locked in with 1 vendor, there's not a lot of motivation for them to discount that second time around the resigning of a contract.