UPM Annual Report 2018

First page Table of contents Previous page 82-83 Next page Last page

UPM AT A GLANCE

STRATEGY

BUSINESSES

SOCIETY AND ENVIRONMENT

GOVERNANCE AND COMPLIANCE

REPORT OF THE BOARD OF DIRECTORS

FINANCIAL STATEMENTS

AUDITOR’S REPORT

OTHER FINANCIAL INFORMATION

Actions to ensure compliance We strive to ensure compliance with our values and commitments by training employees, raising awareness through active communication and developing our risk management, monitoring and reporting processes. Training and communication We arrange compliance trainings, including face-to-face trainings to specific target groups, which are defined based on risk assessments. Over the year, we improved our training tools and processes so that all e-learning modules are now available under the same HR platform and easily accessible by our employees. Thanks to this platformwe are now able to manage our trainings more effectively through automated reminders and escalation processes and we can also produce training reports more easily. Our implementation project related to the General Data Protection Regulation (GDPR), which began in 2016, was completed on schedule and the target group was trained over the course of the year. More detailed, risk- based training was provided to specified target groups such as employees in HR, IT and Legal functions. The processes and tools, as well as post-project organisation, were set up during the implementation project to ensure GDPR compliance by May 2018 and thereafter. The UPMCode of Conduct was last amended in February 2016; in 2018 we initiated a project to refresh the UPMCode of Conduct in order to ensure that it continues to reflect

Governance guidelines We comply with all recommendations of the Finnish Corporate Governance Code for listed companies issued by the Finnish Securities Market Association. This Code is available on the association’s website at www.cgfinland.fi/ en. In accordance with the Code, we have published our Corporate Governance Statement for the financial year 2018 and this statement is available on the corporate website at www.upm.com/governance. We refer to this statement for information on our governance structure and guidelines, Board and committee duties and responsibilities, and our management and control procedures related to internal control, risk management, internal audit, insider administration and related party transactions. In the following, we report on the decisions taken at our Annual General Meeting, changes in the Board of Directors, Board diversity and independence, Board and committee work, executive management, Board and management remuneration, auditor and auditor remuneration in 2018. Our Annual General Meeting (AGM) took place in Helsinki, Finland on 5 April 2018. A total of 3,386 shareholders were present or represented at the meeting, representing 52.2% of the company’s registered shares and votes. We were pleased to have a record number of shareholders present or represented at the meeting. The AGM adopted the company’s Financial Statements and decided to distribute a dividend of EUR 1.15 (for the year 2016: EUR 0.95) per share and discharged the members of the Board of Directors and the President and CEO from liability for the financial year 2017. The dividends, totalling EUR 613 million, were paid on 19 April 2018 to shareholders who were registered in our shareholders’ register on 9 April 2018. The year 2017 marked the fourth consecutive year of increased dividend (read General meeting of shareholders

NUMBER OF REPORTED CASES RELATING TO 2018 Fraud 4 Discrimination 3 IPR/Confidential data 2 Conflict of interest 5 General human resources 17 Environment 1 None of the cases was related to corruption. Three cases led to disciplinary action, including warnings and terminations of employment. • Number of other inquiries or concerns: 215 In order to strengthen the speak-up culture and to harmonise our procedures, principles, roles and responsibilities with regard to the reporting and investigation of misconduct and other concerns, the Group Executive Team approved an updated version of our misconduct investigation protocol in November. Updated rules under the UPMCode of Conduct approved by the Group Executive Team in 2018 include the Safety Rules and HR Rules. Monitoring Our group company risk matrix, which is based on country risk and complexity and extent of our operations in each country, forms the basis for monitoring activities aimed at ensuring compliance at all levels of the organisation. Our compliance team, which is headed by the Chief Compliance Officer, has a three-year- monitoring plan for its compliance reviews based on this matrix. The reviews to be performed each year are agreed with the businesses during the annual risk assessment process and coordinated with Internal Audit. Findings and recommendations of the compliance reviews are reported to the Audit Committee and businesses and implementation of the recommendations are executed together with the businesses. Reporting The UPMReport Misconduct channel is available on the corporate website for all stakeholders and on the UPM Intranet for our employees. Stakeholders and employees may use this channel to report any complaints or concerns they have in relation to violations against the UPMCode of Conduct, any policies or rules thereunder or applicable laws to our Head of Internal Audit and Security Director. • Number of submissions through the channel or directly to Internal Audit in 2018: 32

our transformed business operations, evolving business environment and stakeholder expectations. We plan to present a revised version of the Code of Conduct for the Board approval in April 2019, followed by extensive communication and training to enhance our employees’ awareness and understanding of the Code of Conduct. Our compliance trainings are supported by active communication and since our employees’ awareness of our culture of integrity is a prerequisite for compliance, and therefore we allocated even more resources to this. Risk management Our counterparty risk management project continued in 2018. The project was initially launched in 2017 and it is now in its implementation phase with a planned go-live in 2019. The purpose of the project is to provide a new tool and improved processes for the management of risks relating to our numerous counterparties in different continents and countries. We want to know with whomwe trade and to source even more responsibly. We also want to be able to manage uncertainties relating to trade sanctions more effectively. The new tool will support us in preventive decision-making with automatic screening and alert functionalities and will provide us with improved tracking and documentation trails.

agm2018 . The AGM approved all Board proposals and all decisions were taken without voting. Board of Directors The Board carries the main responsibility for the governance of the company, with the focus on overseeing the long-term value creation of UPM. To fulfil its role effectively, the Board: • Sets the company’s strategic objectives; • Reviews and approves financial and other plans relevant to the achievement of these objectives; and • Reviews the management’s performance in meeting these objectives. The Board’s other main responsibilities relate to the integrity of the company’s financial reporting, effectiveness of internal control and risk management systems, and the appointment, remuneration and succession planning of the senior management of the company. Board composition The composition of the Board changed in 2018 whenWendy E. Lane, UPM’s director since 2005, did not stand for re-election. Having

more on page 17 of this report). For the year 2018, the Board of Directors has proposed a dividend of EUR 1.30 per share. Amendments to the Articles of Association Our Articles of Association were amended during the year as the AGM approved the Board of Directors’ proposals for the amendments to Articles 2, 8 and 10 of the Articles of Association and resolved to remove Article 12 regarding a shareholder’s obligation to make a mandatory bid. Article 2 was amended to reflect the Company’s businesses more closely, Article 8 to correspond to the statutory responsibility for the auditor oversight, and Article 10 to the effect that the entire notice of the general meeting will be published only on the corporate website. Article 12 was removed from the Articles of Association as obsolete and difficult to apply in practice as it coincided with a shareholder’s statutory obligation to make a mandatory bid. The amended Articles of Association are available on the corporate website. Information on other decisions taken at the AGM is available later in this report and on the corporate website at www.upm.com/

COMPLIANCE MONITORING

REGULAR DISCUSSIONS WITH MANAGEMENT , monitoring significant projects, training rate monitoring, implementation of risk mitigation plan

REGULAR COMPLIANCE REVIEWS based on group company risk matrix

UPM BUSINESS AREAS AND OTHER OPERATIONS

REGULAR DISCUSSIONS WITH EMPLOYEES , third party due diligence and risk monitoring, reports through UPM Report misconduct channel, EES and other employee surveys

BOARD COMPOSITION IN 2018

DIRECTOR SINCE

NO. OF TERMS

AGE (AT THE END OF 2018)

INDEPENDENCE OF THE COMPANY

NON-EXECUTIVE / EXECUTIVE DIRECTOR

DIRECTOR

Björn Wahlroos (Chairman)

2008 2002 2015 2013 2018 2007 2014 2007 2015 2012

11 17

66 68 49 43 60 58 67 61 56 58

Independent Independent Independent Independent Independent Independent Independent Independent Independent

NED NED NED NED NED NED NED NED NED ED

Berndt Brunow (Deputy Chairman)

COMPLIANCE TRAININGS TO SPECIFIC TARGET GROUPS IN 2018

COMPLETION RATES AS AT 31 DECEMBER 2018

SIZE OF TARGET GROUP

Henrik Ehrnrooth Piia-Noora Kauppi Marjan Oudeman* )

4 6 1

Code of Conduct e-learning

99% 96% 96% 84% 99%

18,500 7,200 7,200 3,400 7,200

Personal data protection e-learning

Jussi Pesonen Ari Puheloinen

Non-independent

Anti-corruption e-learning Competition law e-learning* ) Confidentiality e-learning

Veli-Matti Reinikkala