UPM Annual Report 2019

Non-financial information Global megatrends represent many long-term opportunities and challenges for UPM towards 2030 and beyond. They are also driving demand for sustainable solutions and responsible business practices. To steer its responsibility activities, UPM has established a set of responsibility focus areas with targets and key performance indicators. They are reviewed every year based on a materiality analysis (page 65). The focus areas cover economic, social and environmental responsibility. Economic responsibility at UPM covers economic performance, good governance and compliance, as well as responsible sourcing. Social responsibility focuses on respecting human rights, occupational health and safety and UPM’s role as a responsible employer. Environmental responsibility includes sustainable products, the climate and use of forests, as well as water use and waste reduction. Mitigation of and adaptation to climate change is becoming more important all the time, and it is relevant for UPM throughout the whole value chain: land use, production and products. Product stewardship is a key element of UPM’s responsibility practices. UPM’s Biofore strategy guides the company in achieving its responsibility targets for 2030 and in contributing to the Sustainable Development Goals (SDG) of the 2030 Agenda for Sustainable Development published by the UN. In 2019, UPM reviewed its selection of most material SDGs in a comprehensive evaluation and several workshops. Based on international frameworks and commitments UPM respects international human rights agreements and agreements concerning labour rights, including the UN Declaration of Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. Since 2003, UPM is a signatory of the UN Global Compact initiative, whose ten universal principles are derived from international agreements in the areas of human rights, labour standards, the environment and anti-corruption. And since 2016, UPM has the LEAD participant status for its commitment to the UN Global Compact. In 2019, UPM was one of only 36 global companies to receive this recognition, and the only representative of the forest industry and Finland. Regarding climate change UPM committed to the Science Based Targets (SBT) initiative in 2017 and received validation of the targets in 2019. To further strengthen group approach, UPM committed to the UN's Business Ambition for the 1,5°C pledge. UPM follows the Finnish Corporate Governance Code issued by the Securities Market Association and complies with all of its recommendations. UPM Code of Conduct and other corporate policies UPM’s decision making, management and operations are guided by UPM values and the UPM Code of Conduct. Legal compliance and responsible practices are the foundation of all of UPM’s businesses and create long-term value for both UPM and its stakeholders. The UPM Code of Conduct emphasises UPM’s commitment to business integrity and responsible business operations, manifesting the company’s guiding principles. The UPM Code of Conduct is complemented by more detailed policies approved by the Board of Directors and rules approved by the Group Executive Team, business areas or global functions. These policies and rules cover such topics as treasury, taxes, disclosures, insider matters, anti-corruption, competition law, confidentiality, contract management, human resources, the environment, forestry, information security and data protection, and safety.

Management of non-financial matters UPM’s responsibility thinking starts with anticipating, mitigating and managing risks, and extends to creating a competitive advantage and long-term value. UPM continually strives to reduce its risk exposure and improve its performance by using tools such as certified management systems. The majority of UPM’s production sites, as well as its forestry operations, are covered by quality, environmental and health and safety systems, which are certified in accordance with the ISO 9001, ISO 14001 and OHSAS 18001 standards, respectively. All European pulp and paper mills, as well as the UPM Fray Bentos pulp mill in Uruguay and the UPM Changshu paper mill in China, also adhere to the EU’s ecomanagement and audit scheme (EMAS). Many of the sites also have energy management systems certified under ISO 50001 or the Finnish ETJ+ system, and food safety management systems certified under ISO 22000. Should stakeholders have any concerns or suspect misconduct, they are encouraged to contact UPM or to use the UPM Report Misconduct channel. This channel is available on UPM’s intranet for UPM employees, and also on the corporate website for the company’s external stakeholders. In 2019, 31 (32) cases were reported either through the UPM Report Misconduct channel or directly to internal audit. Five cases led to disciplinary action including warnings and terminations of employment. Reporting framework used UPM uses the GRI Standards reporting guidelines published by the Global Reporting Initiative to measure and report on corporate responsibility at group level. UPM’s corporate responsibility reporting has been compiled in accordance with the GRI Standards: Core option. Committed to anti-corruption The UPM Code of Conduct underlines the company’s zero tolerance attitude towards corruption and bribery in any form. UPM Anti- Corruption Rules explain prohibited conduct and expected ethical behaviour in further detail. UPM performs anti-corruption risk assessment on a regular basis. The annual risk-assessment process includes a top-down risk discussion with the management of each business area. All UPM group entities are also assessed on the basis of country risk and complexity of operations. UPM operates globally and has significant manufacturing operations in several emerging market countries. Such operations require a number of permits and other licenses from the relevant authorities. Some of the countries where UPM operates are perceived as highly corrupt or corrupt according to Transparency International. In these countries, there is an increased risk of corruption, for example in relation to interaction with government officials and in the use of intermediaries when applying for permits and licences requiring governmental approval. Due diligence of suppliers and third parties with whom UPM does business is an essential part of UPM’s anti-corruption compliance programme. UPM requires that due diligence is performed before entering into or renewing any contract with a third party that meets specified criteria. UPM requires anti-bribery contract terms to be included in agreements with such third parties outlining the third party’s commitment to compliance with applicable anti-bribery laws and UPM’s right to audit the third party to verify compliance with these terms. The company also has corresponding due diligence procedures for joint ventures, including mergers and acquisitions. The company’s anti-corruption training covers all white-collar employees. In 2019, the company updated its Code of Conduct and organised approximately 40 training workshops in 14 countries. UPM also implemented its initiative, launched in 2017, to further enhance due diligence procedures through automated screening solutions and performed risk-based compliance reviews in selected jurisdictions and operations.

Respect for human rights UPM is committed to respecting human rights. UPM has assessed all its operations and activity and has identified the potential human rights issues and impacts. When considering both the severity and likelihood of these potential issues and impacts, UPM considers the salient human rights issues in the company’s sphere of influence to be environmental pollution, occupational health and safety (OHS), working conditions, protection of children, and forced labour. In 2019, UPM reviewed its Human Resources Rules and clarified its commitments to working conditions, labour practises and decent work, and employee’s responsibilities. Furthermore, UPM agreed on a salient human rights issue assessment practise on a business area level, which complements the existing human rights due diligence at UPM. The practise was piloted at UPM Raflatac. Responsible sourcing UPM requires its suppliers, third-party intermediaries and joint venture partners to apply the same principles as in the UPM Code of Conduct including commitment to anti-corruption, environmental and social responsibility, safe products, human rights and occupational health and safety practices. Transparent supplier requirements are the basis for responsible sourcing. These supplier requirements are defined in the UPM Supplier and Third Party Code (available on the corporate website). A number of additional requirements are in place for the sourcing of wood, chemicals, pulp and packaging materials, as well as for safety and logistics. All contractors working on site go through UPM’s safety requirements and a web-based safety induction training. UPM carries out supplier risk assessments. The responsibility- related risks are determined by the country of origin, sourced material or service, and complexity of supply chain. Based on the risk assessment, selected suppliers’ activities are evaluated in more detail through annual surveys, supplier audits and joint development plans. In 2019, the UPM Supplier and Third Party Code was updated in line with the revised UPM Code of Conduct. UPM also enhanced its supplier screening and risk mitigation. A new counterparty risk management tool offers better visibility into counterparty-related risks through automated screening and support businesses in ethical and preventive decision-making. UPM continued its cooperation with Together for Sustainability (TfS), a chemical industry initiative that promotes and improves sustainability practices within the supply chains. TfS membership also gave UPM access to EcoVadis assessments and TfS member sustainability audit reports. In 2019, UPM conducted over 400 environmental and social risk assessments with EcoVadis and initiated first TfS audits. Social and employee-related matters UPM’s responsibility focus areas in social and employee-related matters are: learning and development, responsible leadership, diversity and working conditions. UPM promotes active employee participation and consultation, organised in accordance with international and national rules and regulations. UPM aims to empower and engage employees at all levels through responsible leadership. UPM encourages its employees to pursue professional growth and supports them in learning skills and developing them further. UPM respects the privacy of employees and promotes equal opportunities and objectivity in employment and career development. All UPM employees are treated as individuals regardless of gender, age, ethnic origin, nationality, etc. UPM promotes employees' health and wellbeing. Safety is an essential part of UPM’s activities and business management system. Equal safety requirements are applied to all employees, visitors and contractors working at UPM’s premises. In its People Strategy, UPM focused on leadership and creating safe, inclusive & diverse working environment, as well as aiming

UPM requires its suppliers, third party intermediaries and joint venture partners to apply the same principles as in the UPM Code of Conduct and to fulfil criteria concerning social and environmental responsibility. These requirements are defined in the UPM Supplier and Third Party Code. The UPM Code of Conduct has been updated during 2019. The launch of the updated Code of Conduct was followed by extensive communication and training efforts to enhance our employees' awareness and understanding of its contents. Roles of the group management and functions in leading non-financial matters The Board of Directors, with the assistance of the Audit Committee, is responsible for monitoring compliance with applicable legal and regulatory requirements and with the UPM Code of Conduct and other corporate policies. In addition, the Audit Committee oversees procedures for treatment of complaints and concerns received by the company, anonymous or otherwise. As part of the committee’s compliance review, the committee is provided with a quarterly report by the company’s Chief Compliance Officer, and a report of submissions under the company’s Report Misconduct channel by the Head of Internal Audit. In line with its main duties and responsibilities, the Board reviewed and approved updated strategic plans during its strategy session in May 2019. The main focus areas of the UPM Biofore strategy continue to be performance, growth, innovation, responsibility and portfolio development. This strategy is enhanced by the brand promise: Beyond Fossils (read more on pages 16–17). An essential part of the Board’s annual strategy work is to review and assess strategic and operational risks and opportunities (see UPM Governance Statement 2019). These risks and opportunities and their impact on operations and strategy are described on pages 28–29. The Group Executive Team, headed by the President and CEO, is in charge of the management of corporate responsibility, determining courses of action and guiding development work. In practice, corporate responsibility efforts take place in businesses and functions, and in the Group’s Responsibility team, which co-ordinates the projects carried out by businesses and functions. The management of climate change related issues was further strengthened in 2019 with specific topics, such as UPM's resilience in different climate scenarios, reported directly to the Strategy Team. Generally, in the high-emission scenario, physical impacts dominate, and in low- and medium-emission scenarios the transition impacts play a bigger role. In low- and medium-emission scenarios, UPM is well positioned as our business portfolio allows for flexibility regarding recognised risks and opportunities. Based on the scenario work and the outcome of the project, climate-related targets were revised (see pages 86–87). UPM Legal Function and its Compliance team manage legal compliance programmes and arrange related training at regular intervals for specific target groups, which have been defined based on risk assessments. UPM Sourcing organisations follow clearly defined selection and follow-up processes when evaluating suppliers. Strategic fit, service range, product performance, quality, price and sustainability are the key factors when selecting and evaluating suppliers. While executing strategies, UPM and its business areas, functions and production units are exposed to a number of financial and non-financial risks and opportunities. Each business area, function and unit is responsible for identifying, measuring and managing risks related to its own operations, and for reporting on risk exposures, risk management activities and results to its own management team and to the Risk Management Function.

132

133

UPM ANNUAL REPORT 2019

UPM ANNUAL REPORT 2019

CONTENTS

ACCOUNTS

REPORT OF THE BOARD OF DIRECTORS

REPORT OF THE BOARD OF DIRECTORS