UPM Annual Report 2019

UPM’S CORPORATE RESPONSIBILITY REPORTING IN ACCORDANCE WITH GRI STANDARDS AND AA 1000 UPM follows the Global Reporting Initiative’s (GRI) Sustainability Reporting Standards in its corporate responsibility reporting. The reporting has been prepared in accordance with the GRI Standards: Core option. Our GRI index document shows where the disclosures of material topics and general disclosures are addressed in the Annual Report, on UPM’s webpage or in the GRI index document itself. It also includes information on omissions, additional explanations and disclosures on the management approach. The document is available on the UPM webpage upm.com/responsibility. UPM is also committed to the principles of inclusivity, materiality and responsiveness as defined in the AA 1000 AccountAbility Principles Standard (2008). The English version of the corporate responsibility information for 2019 has been assured by an independent third party, PricewaterhouseCoopers Oy (see the Independent Assurance Report below) and identified in the GRI content index. Congruence between the English and Finnish version has been checked.

INDEPENDENT PRACTITIONER’S ASSURANCE REPORT

To theManagement of UPM-Kymmene Corporation We have been engaged by the Management of UPM-Kymmene Corporation (hereinafter also “the Company”) to perform a limited assurance engagement on selected corporate responsibility information for the reporting period 1 January to 31 December 2019, disclosed in UPM-Kymmene Corporation’s Annual Report 2019 and on its website in section “Responsibility” (hereinafter “the CR Reporting”). The assured information is indicated in the Company’s GRI Content Index 2019 on the Company’s website. Furthermore, the assurance engagement has covered UPM-Kymmene Corporation’s adherence to the AA1000 AccountAbility Principles with moderate (limited) level of assurance. Management’s responsibility The Management of UPM-Kymmene Corporation is responsible for preparing the CR Reporting in accordance with the Reporting criteria as set out in the Company’s reporting instructions and the GRI Standards Sustainability Reporting Guidelines of the Global Reporting Initiative. The Management of UPM- Kymmene Corporation is also responsible for such internal control as the management determines is necessary to enable the preparation of CR Reporting that is free frommaterial misstatement, whether due to fraud or error. The Management of UPM-Kymmene Corporation is also responsible for the Company’s adherence to the AA1000 AccountAbility Principles of inclusivity, materiality and responsiveness as set out in AccountAbility’s AA1000 AccountAbility Principles Standard 2008. Practitioner’s responsibility Our responsibility is to express a limited assurance conclusion on the CR Reporting

• Interviewing senior management of the Company. • Interviewing employees from various organisational levels of the Company with regards to materiality, stakeholder expectations, meeting of those expectations, as well as stakeholder engagement. • Assessing stakeholder inclusivity and responsiveness based on the Company’s documentation and internal communication. • Assessing the Company’s defined material corporate responsibility topics as well as assessing the CR Reporting based on these topics. • Visiting the Company’s Head Office as well as two sites in Finland. • Interviewing employees responsible for collecting and reporting the information presented in the CR Reporting at the group level as well as at the site level. • Assessing how group employees apply the reporting instructions and procedures of the Company. • Testing the accuracy and completeness of the information from original documents and systems on a sample basis. • Testing the consolidation of information and performing recalculations on a sample basis. Limited assurance conclusion Based on the procedures we have performed and the evidence we have obtained, nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation’s CR Reporting for the reporting period ended 31 December 2019 is not properly prepared, in all material respects, in accordance with the Reporting criteria, or that the CR Reporting is not reliable, in all material respects, based on the Reporting criteria. Furthermore nothing has come to our attention that causes us to believe that

UPM-Kymmene Corporation does not adhere, in all material respects, to the AA1000 AccountAbility Principles. When reading our assurance report, the inherent limitations to the accuracy and completeness of sustainability information should be taken into consideration. Our assurance report has been prepared in accordance with the terms of our engagement. We do not accept, or assume responsibility to anyone else, except to UPM-Kymmene Corporation for our work, for this report, or for the conclusions that we have reached. Observations and recommendations Based on the procedures we have performed and the evidence we have obtained, we provide the following observations and recommendations in relation to UPM-Kymmene Corporation’s adherence to the AA1000 AccountAbility Principles. These observations and recommendations do not affect the conclusions presented earlier. Regarding Inclusivity: UPM- Kymmene Corporation has processes in place for stakeholder inclusivity and engagement. Stakeholder Relations coordinates stakeholder engagement at the group level, while businesses are responsible for local activity. We recommend that the Company continues inclusive dialogue across different stakeholder groups to meet stakeholder expectations also in the changing markets. Regarding Materiality: UPM- Kymmene Corporation has a systematic process in place to evaluate and determine the materiality of corporate responsibility topics. Materiality analysis is updated annually. We recommend that the Company continues to further develop proactive dialogue with its stakeholders to determine and evaluate material topics. Regarding Responsiveness: UPM- Kymmene Corporation has processes in place for responding to stakeholder needs.

and on the Company’s adherence to the AA1000 AccountAbility Principles based on the procedures we have performed and the evidence we have obtained. We conducted our limited assurance engagement in accordance with the International Standard on Assurance Engagements (ISAE) 3000 (Revised) “Assurance Engagements Other than Audits or Reviews of Historical Financial Information”. That Standard requires that we plan and perform the engagement to obtain limited assurance about whether the CR Reporting is free frommaterial misstatement. In addition, we have conducted our work in accordance with the AA1000 Assurance Standard 2008. For conducting a Type 2 assurance engagement as agreed with the Company, the AA1000AS (2008) requires planning and performing of the assurance engagement to obtain moderate (limited) assurance on whether anymatters come to our attention that cause us to believe that UPM-Kymmene Corporation does not adhere, in all material respects, to the AA1000 AccountAbility Principles and that the CR Reporting is not reliable, in all material respects, based on the Reporting criteria. In a limited assurance engagement the evidence-gathering procedures are more limited than for a reasonable assurance engagement, and therefore less assurance is obtained than in a reasonable assurance engagement. An assurance engagement involves performing procedures to obtain evidence about the amounts and other disclosures in the CR Reporting, and about the Company’s adherence to the AA1000 AccountAbility Principles. The procedures selected depend on the practitioner’s judgement, including an assessment of the risks of material misstatement of the CR Reporting and an assessment of the risks of the Company's material nonadherence to the AA1000 AccountAbility Principles. Our work consisted of, amongst others, the following procedures:

We recommend that the Company continues developing a systematic approach both to obtaining and acting on stakeholder feedback. Practitioner’s independence, qualifications and quality control We have complied with the independence and other ethical requirements of the Code of Ethics for Professional Accountants issued by the International Ethics Standards Board for Accountants, which is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. Our multi-disciplinary team of corporate responsibility and assurance specialists possesses the requisite skills and experience within financial and non- financial assurance, corporate responsibility strategy and management, social and environmental issues, as well as the relevant industry knowledge, to undertake this assurance engagement. PricewaterhouseCoopers Oy applies International Standard on Quality Control 1 and accordingly maintains a comprehensive system of quality control including documented policies and procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

Helsinki 17 February 2020 PricewaterhouseCoopers Oy Sirpa Juutinen Partner

Jussi Nokkala Director Sustainability & Climate Change

Sustainability & Climate Change

116

117

UPM ANNUAL REPORT 2019

UPM ANNUAL REPORT 2019

GOVERNANCE

GOVERNANCE

CONTENTS