UPM Annual Report 2017

Governance

In brief

Strategy

Businesses

Stakeholders

Accounts

UPM Report Misconduct channel is available on the corporate website for all stakeholders and on the UPM intranet for the group employees. Number of submissions through the channel or directly to internal audit in 2017: 34. Number of other inquiries or concerns: 220

98%

18

We also aim higher in our governance. We are committed to good governance and compliance with the guiding principles contained in the UPMCode of Conduct and compliance with applicable laws and regulations. We trust that our governance structure supports good governance, responsible business operations and compliance at all levels with clear responsibilities and reporting lines. Our governance structure is presented on the corporate website and in the Corporate Governance Statement 2017 which is also available on the corporate website www.upm.com/governance. Governance of compliance Our compliance system is embedded in our governance model and is designed to support company performance and a culture of integrity at all levels. The main emphasis of the system is on preventive actions, which are based on the annual risk management cycle and risk assessments conducted in all businesses and operations. UPM’s compliance system and actions within this system are presented in the illustration on the right. The risk manage­ ment process is described in the Corporate Governance Statement 2017. Responsibility for compliance extends from the Board of Directors to every UPM employee, as described in the table below. We strive to ensure compliance with our values and commitments by training employees, by raising awareness through active communication and by developing our risk management, monitoring and reporting processes. Compliance trainings are arranged for specific target groups, which are defined based on risk assessments.

Our decision making, management and operations are guided by our values and the UPM Code of Conduct. Our leading principle is that we do not compromise our standards of integrity under any circumstances.

of active employees had completed the UPM Code of Conduct training “Every choice matters” at the end of 2017

The number of languages UPM Code of Conduct is available on the UPM intranet and on the corporate website www.upm.com/governance.

REPORTED CASES RELATED TO

2017

None of the cases was related to corruption or discrimination. Four cases led to disciplinary action including warnings and terminations of employment.

Fraud

4 2 4 9

IPR/Confidential data

Conflict of interest

General human resources

Miscellaneous

15

COMPLIANCE TRAININGS TO SPECIFIC TARGET GROUPS IN 2017

SIZE OF TARGET GROUP

Code of Conduct Anti-corruption Competition law Confidentiality

18,600

7,200 3,300 7,200

Market abuse regulation (insider matters)

330

UPM COMPLIANCE SYSTEM

Company performance Corporate reputation, financial performance, operational excellence

Our governance

PREVENT

Risk assessment Policies and procedures Preventive controls

Communication Training Proactive advice

Continuous improvement

Auditing, monitoring and surveys Notification/ reporting channels

REACT

MONITOR

Investigation and resolution Remediation

Culture of integrity

RESPONSIBILITIES IN THE UPM COMPLIANCE SYSTEM Board of Directors

RESPONSIBILITIES IN UPM COMPLIANCE SYSTEM Disclosure Committee

Approves company values and corporate policies and monitors compliance therewith Assists the Board in monitoring compliance by reviewing quarterly assurance and compliance reports Top-level commitment, manages and oversees the company’s daily business operations Top-level commitment, assists the President and CEO with the approval and execution of group-level rules and procedures Top-level commitment, implementation of group-level rules and procedures in businesses, review of risk management and assurance

Assesses compliance with applicable disclosure requirements

Audit Committee

Assurance Committee

Co-ordinates quarterly group-level assurance reports and oversees compliance with applicable financial reporting requirements Maintains the company’s Report Misconduct channel, conducts investigations and reports quarterly to the Audit Committee Owns the UPM Code of Conduct, oversees the compliance system and manages legal compliance programmes, and reports quarterly to the Audit Committee Make the right choices in everyday work

Our principles under UPM Code of Conduct

President and CEO

Head of Internal Audit

We are committed to integrity We respect people and human rights We take care of our environmental impact and product safety We have zero tolerance for corruption and bribery

Group Executive Team

Chief Compliance Officer

Business Area Boards

We know with whom we trade We comply with competition law We protect our assets and information We source responsibly We engage with our stakeholders and society We voice our concerns

UPM employees

Strategy Team Integrates integrity and responsibility in company strategies Ethics Advisory Committee Oversees investigation of alleged misconduct and provides advice on remediation actions

Auditor

Provides quarterly assurance reports to the Audit Committee, semi-annual assurance reports to the Board of Directors and an annual Auditor’s Report to the shareholders

CONTENTS

UPM Annual Report 2017 76

UPM Annual Report 2017 77