United States District Court, D. Colorado
ORDER GRANTING MOTION TO DISMISS
William J. Martínez United States District Judge
a shareholder derivative action brought by Sean Gubricky
nominally against Chipotle Mexican Grill, Inc.
(“Chipotle”), and in reality against ten Chipotle
directors and officers (together, “Defendants”).
(See ECF Nos. 1 (redacted complaint), 20
(unredacted, restricted complaint).) Gubricky's complaint
stems from a series of foodborne illness outbreaks linked to
Chipotle stores in the latter half of 2015. Gubricky alleges
that Chipotle's directors shirked their duty to properly
oversee the company, thus leading to the outbreaks and
substantial harm to Chipotle as a company.
the Court is Defendants' Motion to Dismiss. (ECF No. 52.)
For the reasons explained below, the Court agrees with
Defendants that Gubricky has failed to plead demand futility
under controlling Delaware standards. The Court therefore
grants Defendants' Motion, but without prejudice so that
Gubricky may consider whether to make a demand on
Chipotle's board of directors (the “Board”).
If Gubricky informs the Court that he has chosen not to make
a demand, the Court will convert this dismissal to
“with prejudice” and enter final
Events Preceding the 2015 Outbreaks
Kent, Ohio & the Norwalk Protocol (April 2008)
April 2008, more than 500 people became ill after eating at a
Chipotle restaurant located near Kent State University in
Kent, Ohio.” (ECF No. 20 ¶ 78.) This outbreak
“was rumored to have been linked to an infectious
wake of this incident, Chipotle “purportedly
established” the “Norwalk Protocol, ” which
requires an employee not to return to work for five days if
the employee vomits or suffers from a combination of
diarrhea, nausea, fever, or stomach cramps. (Id.
¶¶ 79, 80.) If Chipotle receives two or more
complaints of illness linked to a Chipotle restaurant, the
Norwalk Protocol also apparently calls for shutting down the
restaurant temporarily so that it may be cleaned and
sanitized. (Id. ¶ 47.)
Chipotle's 2014 10-K (February 2015)
February 4, 2015, Chipotle filed its SEC Form 10-K for the
year 2014. (Id. ¶ 77.) Among the potential
risks Chipotle noted was a comparatively heightened risk of
food poisoning based on Chipotle's business model:
“We may be at a higher risk for food-borne illness
outbreaks than some competitors due to our use of fresh
produce and meats rather than frozen, and our reliance on
employees cooking with traditional methods rather than
automation.” (Id. (internal quotation marks
Paid Sick Leave Policy Change (June/July 2015)
or July 2015, Chipotle changed its paid sick leave policy to
provide employees with five paid sick days if they have been
with Chipotle for a year or longer, but no paid sick days for
employees with less than a year on the job. (Id.
¶¶ 47, 69, 79.) The complaint does not allege
Chipotle's paid sick leave policy before this change.
The 2015 Outbreaks
Hazel Dell, Washington, Outbreak (Early August 2015)
early August 2015, a manager at a Chipotle restaurant in
Hazel Dell, Washington, told a sick employee that she needed
to come in to work or find someone to cover for her.
(Id. ¶¶ 42-43.) The employee came to work,
stayed for four hours, and was vomiting during that time.
(Id.) A norovirus outbreak ensued in Hazel Dell,
which the Washington State Department of Health linked to the
sick employee at Chipotle. (Id.) The complaint does
not describe the extent of this outbreak, nor does it allege
that the Board members were aware of this outbreak at any
time relevant to this lawsuit.
Simi Valley, California, Outbreak (Late August 2015)
the week of August 18, 2015, a Chipotle restaurant in Simi
Valley, California, became the epicenter of another norovirus
outbreak, this one sickening at least 234 people.
(Id. ¶ 44.) A Wall Street Journal
article later asserted that Chipotle knew as of August 18
that one Simi Valley employee had been complaining of
gastrointestinal illness-whether on duty or not is unclear
from Gubricky's summary of the article-but Chipotle
continued to serve food there. (Id. ¶¶ 46,
48.) A later report by the Ventura County Environmental
Health Division reached a similar conclusion. (Id.
¶ 48.) Gubricky alleges, however, that the Board itself
did not learn of the Simi Valley outbreak until several
months later. (Id. ¶ 89.)
instituted its Norwalk Protocol to shut down and sanitize the
restaurant on August 20, 2015, and it first contacted local
health officials on August 21, 2015. (Id.
¶¶ 48, 49.) Inspections on August 24 and 27, 2015,
uncovered a number of health code violations. (Id.
Minnesota Outbreak (August/September 2015)
to the Minnesota Department of Health, sixty-four people who
dined at Chipotle restaurants between August 16 and August
28, 2015, were sickened by salmonella linked to tomatoes
served at twenty-two different Chipotle restaurants in
Minnesota. (Id. ¶ 53.) Symptoms of salmonella
poisoning began manifesting themselves between August 19 and
September 3, 2015, and nine people were hospitalized.
(Id.) The complaint says nothing about whether the
Board was informed of this outbreak at any time relevant to
Internal Corporate Reports (August/September 2015)
to a Board Pre-Read Executive Summary from Chipotle's
Safety, Security and Risk Department provided to the Board on
August 24, 2015 in advance of the Board meeting scheduled for
September 1, 2015, the Safety, Security and Risk Department
stated that ‘there were no material food safety events
this quarter.'” (Id. ¶ 89 (emphasis
removed).) The complaint does not specify what “this
quarter” refers to, which is ambiguous given the
phrasing “there were no material food safety
events, ” implying a quarter already closed (as opposed
to “there have been no material food safety
events this quarter”).
event, Chipotle held an Audit Committee meeting on August 31,
2015. (Id. ¶ 90.) At that time, the Audit
Committee comprised Baldocchi, Charlesworth, Flanzraich, and
Gillett. (Id. ¶ 20.) The Audit Committee
received a report, prepared earlier that month, of the hours
and dollars expended on internal auditing activities as of
July 31, 2015. (Id. ¶ 90 (footnote omitted).)
This appears to be a calendar-year-to-date report. It
informed the Audit Committee that Chipotle had budgeted 303
hours for store audits but had spent only 95, and expected to
spend only 150 more hours (for a total of 245) through the
remainder of 2015. (Id.) It further informed the
Audit Committee that Chipotle had budgeted about $38, 000 for
store audits that year, but so far had spent only about $13,
000, and expected to spend approximately $17, 500 during the
remainder of the year (for a total of about $30, 500).
same report provided figures for a separate “2016 risk
assessment internal audit.” (Id.) The company
had budgeted 61 hours but spent only 1, and had budgeted just
under $11, 000 but spent a little less than $200.
included with this report was a narrative regarding audits
that had been performed that year. Chipotle's Internal
Audit department (sometimes referred to as “IA”),
noted “[m]ultiple instances of non-compliance . . .
including improper cooking procedures” and
“inaccurately marked food items.” (Id.
report additionally included IA's self-evaluation of
Chipotle's performance as compared to standards
established by the Institute of Internal Audit. (Id.
¶ 98.) One of those standards, known as “Standard
2100, ” states that “the internal audit activity
must evaluate and contribute to the improvement of risk
management, control and governance processes using a
systematic and disciplined approach.” (Id.
¶ 100 (internal quotation marks omitted).) IA reported
that Chipotle “Partially Conforms” to the
standard, explaining as follows:
Standard 2100 encompasses risk assessment procedures. It is
considered best practice to take a broader and more
formalized approach in performing risk assessment procedures
than is currently in practice at Chipotle. It is the opinion
of IA that this level of detail is not necessary or
appropriate in the Chipotle environment, and that our risk
assessment procedures include an acceptable level of detail.
However, a third party reviewer may comment that our risk
assessment and evaluation could be more comprehensive.
(ECF No. 40-4 at 4; see also ECF No. 20 ¶ 100.)
held a Board meeting on September 1, 2015. (Id.
¶ 89.) The minutes for that meeting contain nothing
regarding discussion of the Simi Valley outbreak.
(Id.) The complaint does not allege whether the
Board discussed the Hazel Dell or Minnesota outbreaks.
Multistate Outbreak (October/November 2015)
on October 19, 2015, and apparently continuing into early
November, an E. coli outbreak sickened fifty-three people who
had dined at Chipotle restaurants in California, Illinois,
Maryland, Minnesota, New York, Ohio, Oregon, Pennsylvania,
and Washington state. (Id. ¶ 54.) Forty of the
fifty-three cases occurred in Oregon and Washington.
addressed this outbreak for the first time in a November 3,
2015 press release announcing that it had voluntarily closed
forty-three Chipotle restaurants in Oregon and Washington for
deep cleaning and replacement of ingredients, although only
eight restaurants were the subject of investigation.
(Id.) On the doors of these restaurants, Chipotle
announced that they were closed for “equipment
issues” or “supply issues.” (Id.
announced on November 10, 2015 that it would soon reopen all
of the closed stores in Oregon and Washington, claiming,
“Health officials have concluded that there is no
ongoing risk from this incident.” (Id. ¶
60 (internal quotation marks omitted; emphasis removed).)
However, the Food and Drug Administration
(“FDA”), the Centers for Disease Control
(“CDC”), and the Washington and Oregon health
departments were continuing to investigate the incident
overall. (Id. ¶¶ 57-59, 63.)
December 4, 2015, Chipotle issued a press release announcing
that its food safety practices had long been within industry
norms, but it had now adopted a program to implement
practices that were ...