UPM Annual Report 2017

Accounts

In brief

Strategy

Businesses

Stakeholders

Governance

Financial risks Financial risks are described in consolidated financial statements 2017.

Hazard risks

Roles of the management and functions in managing non- financial matters The Board of Directors, with the assistance of the Audit Committee, is responsible for monitoring compliance with applicable legal and regulatory requirements and with the UPM Code of Conduct and other corporate policies. In addition, the Audit Committee oversees procedures for treatment of complaints and concerns received anonymously or otherwise by the company. As a part of the committee’s compliance review, the committee is provided with a quarterly report by the company’s Chief Compliance Officer and a report of submissions under the company’s Report Misconduct channel by the Head of Internal Audit. The Group Executive Team, headed by the President and CEO, is in charge of the management of corporate responsibility, determining the course of action and guiding development work. In practice, corporate responsibility efforts take place in businesses and functions, and in the Group’s Environment & Responsibility team, which coordinates the projects carried out by businesses and functions. UPM Legal Function manages legal compliance programmes and arranges related trainings at regular intervals to specific target groups, which have been defined based on risk assessments. UPM Sourcing organisations follow clearly defined selection and follow-up processes when evaluating suppliers. Strategic fit, service range, product performance, quality, price and sustainability are the important factors when selecting and evaluating suppliers. While executing strategies, UPM and its business areas, functions and manufacturing units are exposed to a number of risks and opportunities. Each business area, function and unit is responsible for identifying, measuring and managing of risks related to its own operations, and for reporting on risk exposures, risk management activities and results to its own management team and to the Risk Management Function. Reporting framework used UPM uses the GRI Standards reporting guidelines published by the Global Reporting Initiative to measure and report on corporate responsibility at group level. UPM’s corporate responsibility reporting has been compiled in accordance with the GRI Standards: Core option. Committed to anti-corruption The UPM Code of Conduct underlines the company’s zero tolerance towards corruption and bribery in any form. UPM Anti-Bribery Rules explain in further detail prohibited conduct and expected ethical behaviour. UPM performs anti-corruption risk assessment on a regular basis. The annual risk assessment process includes a top down risk discussion with the management of each business area. All UPM group entities are also assessed on the basis of country risk and complexity of operations. UPM operates globally and has significant manufacturing operations in several emerging market countries. Such operations require a number of permits and other licenses from authorities. Some of the countries where UPM operates are perceived as highly corrupted or corrupted according to Transparency International. In these countries, there is an increased risk of corruption for example in relation to interaction with government officials and in the use of intermediaries when applying for permits and licenses requiring governmental approval. Due diligence of suppliers and third parties with whom UPM does business is an essential part of UPM’s anti-bribery compliance programme. UPM requires that due diligence is performed before entering into or renewing any contract with a third party which meets specified criteria. UPM requires anti-bribery contract terms to

be included in agreements with such third parties outlining the third party’s commitment to compliance with applicable anti-bribery laws and UPM’s right to audit the third party to verify compliance with these terms. The company has also corresponding due diligence procedures for joint ventures, including mergers and acquisitions. In 2017, the company’s anti-bribery training was extended to cover all white-collar employees. UPM also launched an initiative to further enhance due diligence procedures, implemented a new policy management framework and performed risk-based compliance reviews in selected jurisdictions and operations. Respect for human rights UPM is committed to respecting human rights. UPM has mapped its operations and activity and identified the potential human rights issues and impacts. In considering both the severity and likelihood of these potential issues and impacts UPM considers the salient human rights issues in the company’s sphere of influence to be environmental pollution, occupational health and safety (OHS), working conditions, protection of children, and forced labour . Responsible sourcing UPM requires its suppliers, third-party intermediaries and joint venture partners to apply the same principles as in the UPM Code of Conduct including commitment to anti-corruption, environmental and social responsibility, safe products, human rights and occupational health and safety practices. Transparent supplier requirements are the basis for responsible sourcing. These supplier requirements are defined in the UPM Supplier and Third Party Code (available on the corporate website). A number of additional requirements are in place for sourcing of wood, chemicals, pulp and packaging materials as well as for safety and logistics. All contractors working on site go through UPM’s safety requirements and a web-based safety induction training. UPM’s supplier risk assessment covers financial, quality, environmental, social, economic and delivery related risks. Based on the risk assessments, UPM selects suppliers whose performance is assessed in more detail and uses tools such as annual question­ naires, audits and joint development plans to monitor compliance. In 2017, UPM trained its key personnel on the revised Supplier and Third Party Code, approved in December 2016. Personnel visiting suppliers’ production units regularly were also trained on operational health and safety issues. Social and employee-related matters UPM’s responsibility focus areas in social and employee-related matters are learning and development, responsible leadership, diversity as well as working conditions. UPM promotes active employee participation and consultation, organised in accordance with international and national rules and regulations. UPM aims to empower and engage employees at all levels through responsible leadership. UPM encourages its employees to pursue professional growth and supports them in learning and developing their skills further. UPM respects the privacy of employees and promotes equal opportunities and objectivity in employment and career development. All UPM employees are treated as individuals regardless of gender, age, ethnic origin, nationality, etc. UPM promotes employees' wellbeing and health. Safety is an essential part of UPM’s activities and business management system. Equal safety requirements are applied to all employees, visitors and contractors working at UPM’s premises. In People Strategy, UPM focused on value-based and inspiring leadership, aiming higher in business performance and development of agility and competitiveness in 2017. UPM continued to review the status of diversity in businesses and functions. UPM integrated

CONSOLIDATED FINANCIAL STATEMENT NOTE

TYPE OF RISK Accident, natural event and site security

TYPE OF RISK

Credit risk

4.6 Working capital

UPM operates a significant number of manufacturing facilities globally, mostly UPM owned, and is also the largest private owner of forest land in Finland. UPM also owns a significant plantations area in Uruguay. UPM is exposed to risks in areas such as occupational health and safety, environment, fire, natural events and site security. These risks are managed through established management procedures and loss prevention programmes. UPM’s insurance programme also provides coverage for insurable hazard risks, subject to insurance terms and conditions.

Liquidity and refinancing risk Interest rate risk

5.1 Capital management

6.1 Financial risk management Foreign exchange risk 6.1 Financial risk management Electricity price risk 6.1 Financial risk management

Non-financial information

integrity and responsible business operations manifesting the company’s guiding principles. The UPM Code of Conduct is complemented by more detailed policies approved by the Board of Directors and rules approved by the Group Executive Team, business areas and global functions. These policies and rules cover such topics as treasury, disclosure, insider matters, anti-bribery, competition law, confidentiality, contract management, taxation, human resources, environment, forestry, information security and data protection, safety, and equality. UPM requires its suppliers, third party intermediaries and joint venture partners to apply the same principles as in the UPM Code of Conduct and to fulfil criteria concerning social and environmental responsibility. These supplier requirements are defined in the UPM Supplier and Third Party Code. To ensure compliance UPM uses tools such as annual questionnaires, audits and joint development plans. UPM expects its suppliers to promote the same requirements in their upstream supply chains. Management of non-financial matters UPM’s responsibility thinking starts from anticipating, mitigating and managing risks and extends to creating competitive advantage and long-term value. UPM continually strives to reduce its risk exposure and improve its performance by using tools such as certified management systems. The majority of UPM’s production sites, as well as its forestry operations, are covered by quality, environmental and health and safety systems, which are certified in accordance with the ISO 9001, ISO 14001 and OHSAS 18001 standards respectively. UPM has certified all its European pulp and paper mills, the UPM Fray Bentos pulp mill in Uruguay and UPM Changshu paper mill in China in accordance with the voluntary EU Eco-Management and Audit Scheme (EMAS). Should stakeholders have concerns or suspect misconduct, they are encouraged to contact UPM or to use the UPM Report Misconduct channel. This channel is available on UPM’s intranet for UPM employees, and also on the corporate website for the company’s external stakeholders. In 2017, 34 cases were reported through the UPM Report Misconduct channel or directly to internal audit. The complaints related mainly to suspected cases of fraud and suspected failures to adhere to the company’s HR Rules or compliance procedures. None of the cases were related to corruption or discrimination. Four cases led to disciplinary action including warnings and terminations of employment.

Global megatrends represent many long-term opportunities and challenges for UPM towards 2030 and beyond. They are also driving demand for sustainable solutions and responsible business practices. In order to guide its responsibility activities, UPM has established a set of responsibility focus areas with targets and key performance indicators. They are reviewed every year based on a materiality analysis (page 53). The focus areas cover economic, social and environmental responsibility. In the area of economic responsibility, UPM is focused on economic performance, good governance and responsible sourcing. In the area of social responsibility, the focus is on the fulfilment of human rights, occupational health and safety and UPM’s role as a responsible employer. Environmental responsibility covers climate, use of forests and water, and waste reduction. Product stewardship is a key element in UPM’s responsibility practices . Based on international frameworks and commitments UPM respects international human rights agreements and agreements concerning labour rights, including the UN Declaration of Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. UPM is also a signatory of the UN Global Compact initiative, whose ten universal principles are derived from international agreements in the areas of human rights, labour standards, environment and anti-corruption. UPM is a member of the UN Global Compact LEAD forum as the only representative of the forest industry and the only Finnish participant. UPM’s Biofore strategy guides the company in achieving its responsibility targets for 2030 and in contributing to the Sustainable Development Goals (SDG) of the 2030 Agenda for Sustainable Development published by the UN. UPM follows the Finnish Corporate Governance Code issued by the Securities Market Association and complies with all recommendations of it. UPM Code of Conduct and other corporate policies UPM’s decision making, management and operations are guided by UPM values and the UPM Code of Conduct. Legal compliance and responsible and ethical practices are the foundation of all of UPM’s businesses and create long-term value for both UPM and its stakeholders. The Code emphasises UPM’s commitment to business

CONTENTS

ACCOUNTS

104

105

UPM Annual Report 2017

UPM Annual Report 2017