UPM Annual Report 2019

People

SIGNIFICANCE • Compliance is an integral part of responsibility, one of our strategic focus areas • Compliance helps us to create sustainable business in the long term • Compliance is an important asset in our decision making, management and operations TARGETS • Compliant operations and behaviour • Engaging work environment where employees feel safe to voice their concerns • Responsible value creation OUR WAY • We are all responsible for building a culture of integrity, with everything we do and every choice we make • We do not compromise our standards of integrity under any circumstances • Accountability for compliance extends down from the Board of Directors and senior management to all employees

MAKING THE RIGHT CHOICES We are committed to complying with the applicable laws and regulations, as well as our Code of Conduct, regardless of the location, situation or people involved. Our Code of Conduct and our values help us make the right choices and guide our work in the changing business environment. This builds the foundation for long-term success.

OUR MAIN PRINCIPLES UNDER THE UPM CODE OF CONDUCT

We are committed to integrity We respect people and human rights We take care of our environmental impact and product safety

We have zero tolerance for corruption and bribery

UPM COMPLIANCE SYSTEM

We avoid conflicts of interest We comply with competition law We protect our assets and information We know with whom we trade We engage with our stakeholders and society

Our compliance system is embedded in our governance model and is designed to support company performance and a culture of integrity at all levels. We follow the development of this culture with the help of the Integrity Index, which is an average calculated on the basis of favourable responses to integrity-related questions in our annual Employee Engagement Survey (EES). These questions are: 1. I understand the UPMCode of Conduct and ethical standards. 2. If I had to report unethical behaviour or misconduct, I am confident that it would be handled effectively by UPM. 3. UPM operates in an ethical manner and in accordance with the UPMCode of Conduct.

Our integrity index figure in 2019 was 86% (86%). The main emphasis of our compliance system is on preventive actions, which are based on the annual risk management cycle and risk assessments conducted for all businesses and operations. Our compliance system and actions within this system are demonstrated in the illustration on the right. Actions to ensure compliance We strive to ensure compliance with our values and commitments by training our employees, raising awareness through active communication and developing our risk management, monitoring and reporting processes.

Company performance Corporate reputation, financial performance, operational excellence

PREVENT

Risk assessment Policies and procedures Preventive controls

Communication Training Proactive advice

Continuous improvement

We voice our concerns

Auditing, monitoring and surveys Notification/reporting channels

REACT

MONITOR

Investigation and resolution Remediation

Our compliance team held several training sessions related to the launch of the updated Code of Conduct. One of these sessions was held at our Changshu paper mill in June.

Culture of integrity

who we are trading with and to source even more responsibly. We also want to be able to manage uncertainties relating to trade sanctions more effectively. The new tool supports us in preventive decisionmaking with automatic screening and alert functionalities and provides us with improved tracking and documentation trails. Policies and procedures The UPMCode of Conduct was updated during the year to ensure that it covers all major compliance risk areas and continues to reflect our transformed business operations, evolving business environment and stakeholder expectations. The updated Code of Conduct was approved by the Board in April. It now includes a new section on

Risk assessment With the support of our compliance team, each business area, function and unit is responsible for identifying, measuring and managing compliance risks related to its own operations. The results of annual risk assessments and discussions are used to guide compliance activities andmitigation actions. An example of our compliance team’s mitigation actions is the counterparty risk management project, which was initially launched in 2017 and continued into 2019 with the implementation phase and launch in April. As a result of this project, we now have a new tool and improved processes for the management of risks relating to our numerous counterparties in different countries and continents. We want to know

74

75

OUR WAY

OUR WAY

UPM ANNUAL REPORT 2019

UPM ANNUAL REPORT 2019

CONTENTS