UPM Annual Report 2019

Integrity index based on Employee Engagement Survey results 86% the number of languages in which the UPM Code of Conduct is available on theUPM Intranet and on the corporate website upm.com/governance 19

Code of Conduct training

CASE

%

100

GAMIFICATION BRINGS CODE OF CONDUCT TO LIFE

95

The Code of Conduct, updated in 2019, is a compass for us, guiding our conduct and actions and helping us to make the right decisions at work. All employees were required to take the mandatory Code of Conduct e-learning. To make the e-learning more relevant and engaging, a gamification design approach was taken. In the e-learning training, our employees are given real-life situations that could happen to anyone and asked what they would do in a similar situation. The story spans one day, from the breakfast table to returning home from work, and the e-learner is one of its characters. If your colleague’s posts on social media share too much information, what do you do? If your colleague is harassing your teammate, do you confront him? If your colleague suggests her partner for a job at UPM, how do you react? The characters involved in the scenarios gain or lose points based on the answers given. The e-learners are given multiple answers to choose from in each situation and, by design, the answers aren’t clear-cut — there can be more than one right answer. This way, the e-learning training imitates real life: you do not always immediately know the right choice but have to consider the situation from different angles. The gamification of the e-learning has proven successful. According to feedback, the Code of Conduct is more meaningful. E-learning is a game, but the message comes through clearly. Making the content and spirit of the Code of Conduct more relatable to us and helping us see how it can guide us in our everyday work builds a culture of integrity in everything we do and every choice we make.

90

85

80

15

16

17 18

19

Target

96% 100% coverage of participation in UPM Code of Conduct training (continuous)

TARGETS 2030

of active employees completed the new UPM Code of Conduct training since September 2019

conflicts of interest and places more emphasis on the importance of safety, non-harassment and speak-up culture. Following the Board’s approval of the updated Code of Conduct, the Group Executive Team approved updates to several rules given under the Code of Conduct, including Anti-Corruption Rules, Supplier and Third Party Code and Confidentiality Rules. Training and communication Our compliance trainings are supported by active communication. As our employees' awareness of what is expected from them is a prerequisite for compliance, we continued to allocate further resources to this. In 2019, the launch of the updated Code of Conduct was followed by extensive communication and training efforts to enhance our employees’ awareness and understanding of its contents. These efforts

included launching mandatory e-learning for all employees (readmore on the right), with targeted trainings for salaried and shop floor employees, preparation of materials for manager training and team discussions, as well as the launch of the Code of Conduct mobile application called UPMCode App. In addition, a printed copy of the updated Code of Conduct was distributed to all employees. Tailored version of the Code of Conduct with the most relevant contents was distributed to employees in the production environment. The Code of Conduct e-learning is complemented by other compliance training, including face-to-face training with specific target groups, who are defined based on risk assessments. Our e-learning modules are available under the same HR platform and easily accessible to our employees. Thanks to this platform, we are able to manage our training effectively

any complaints or concerns they have in relation to violations of the UPMCode of Conduct, any policies or rules thereunder or any applicable laws or regulations. Our employees can also report any suspected or observed breach ormisconduct to either their managers or a representative of UPMLegal, HR or Internal Audit functions. We do not tolerate retaliation against any person who, in good faith, reports suspectedmisconduct or participates in an investigation to resolve suspectedmisconduct. The table on the previous page summarises the number of cases reported either through the Report Misconduct channel or directly to Internal Audit. Two cases related to discrimination. Five cases led to disciplinary action, including warnings and terminations of employment.

businesses, and implementation of these recommendations is executed in collaboration with said businesses. In 2019, the compliance team conducted compliance reviews in group companies located in eight different countries in South America, Africa, Asia and Europe. integrity that employees feel comfortable to voice any concerns they have and can trust UPM to take the appropriate action. If we are worried about anything, we must speak up and take action. The UPMReport Misconduct channel is available on the corporate website for all stakeholders and on the UPM intranet for our employees. Stakeholders and employees may use this channel to report to our Head of Internal Audit, Chief Compliance Officer and Security Director Reporting It is an important part of our culture of

through automated reminders and escalation processes, and we can also easily produce training reports. Available compliance e-learnings with the completion rates at year-end are listed in the table below. Monitoring Our group company riskmatrix, which is based on country risk and complexity and theextent of our operations in each country, forms the basis for monitoring activities aimed at ensuring compliance at all levels of the organisation. Our compliance team has a three-year monitoring plan for its compliance reviews that is based on this matrix. The reviews to be performed each year are agreed with the businesses during the annual risk assessment process and coordinated with Internal Audit. The compliance review findings and recommendations are reported to the Audit Committee of the Board of Directors and

upm.com/compliance

UPMers can now easily check the right thing to do with the UPM Code App. The application provides easy access to the Code of Conduct, checklists on different situations and guidelines on how to make the right decisions. It is also a quick way to access the UPM Misconduct Channel to voice concerns.

COMPLIANCE MONITORING

COMPLETION RATES AS OF 31 DECEMBER 2019

REPORTED CASES UNDER REPORT MISCONDUCT CHANNEL UPM Code of Conduct section 2019

COMPLIANCE TRAINING FOR SPECIFIC TARGET GROUPS IN 2019 Code of Conduct e-learning * ) Personal data protection e-learning

SIZE OF TARGET GROUP 18,300

2018

REGULAR DISCUSSIONS WITH MANAGEMENT , monitoring significant projects, training rate monitoring, implementation of risk mitigation plan

Our commitment on integrity Our people and operations Respect people and human rights Taking care of the environmental impact and product safety Business Integrity Zero-tolerance of corruption and bribery

1

1

96 99 99 99 99 99

20

20

7,300 7,300 3,300 7,300

REGULAR COMPLIANCE REVIEWS based on group

2

2

Anti-corruption e-learning Competition law e-learning Confidentiality e-learning Insider Policy e-learning

UPM BUSINESS AREAS AND OTHER OPERATIONS

3 1 1 2

0 8 0 2

company risk matrix

370 * ) Training for the updated Code of Conduct started in September 2019.

Avoid conflicts of interest

Compliance with competition laws Protect assets and information

REGULAR DISCUSSIONS WITH EMPLOYEES , third party due diligence and risk monitoring, reports through UPM Report Misconduct channel, EES and other employee surveys

Our Stakeholders Know with whom you trade

1

0

Total

31

32

76

77

OUR WAY

OUR WAY

UPM ANNUAL REPORT 2019

UPM ANNUAL REPORT 2019

CONTENTS