UPM Annual Report 2020

Regarding Responsiveness: UPM-Kymmene Corporation has processes in place for responding to stakeholder needs. Due to changes in market condi tions, responsiveness towards stakeholder expectations required adjustments. We recommend that the Company maintains its systematic approach to respond to stake holder’s expectations. Practitioner’s independence, qualifications and quality control We have complied with the independence and other ethical requirements of the Code of Ethics for Professional Accountants issued by the International Ethics Standards Board for Accountants, which is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. Our multi-disciplinary team of corpo rate responsibility and assurance specialists possesses the requisite skills and experi ence within financial and non-financial assurance, corporate responsibility strategy and management, social and environmen tal issues, as well as the relevant industry knowledge, to undertake this assurance engagement. PricewaterhouseCoopers Oy applies International Standard on Quality Control 1 and accordingly maintains a comprehensive system of quality control including docu mented policies and procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements.

or that the CR Reporting is not reliable, in all material respects, based on the Report ing criteria. Furthermore, nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation does not adhere, in all material respects, to the AA1000 AccountAbility Principles. When reading our assurance report, the inherent limitations to the accuracy and completeness of sustainability information should be taken into consideration. Our assurance report has been pre pared in accordance with the terms of our engagement. We do not accept, or assume responsibility to anyone else, except to UPM-Kymmene Corporation for our work, for this report, or for the conclusions that we have reached. Observations and recommendations Based on the procedures we have per formed and the evidence we have obtained, we provide the following observations and recommendations in relation to UPM-Kym mene Corporation’s adherence to the AA1000 AccountAbility Principles. These observations and recommendations do not affect the conclusions presented earlier. Regarding Inclusivity: UPM-Kym mene Corporation has processes in place for stakeholder inclusivity both at the group and at the business level. Due to changes in market conditions, additional stakeholder expectations have been considered. We recommend that the Company continues continuous monitoring of changes across stakeholder expectations through estab lished procedures to ensure inclusivity of stakeholders. Regarding Materiality: UPM-Kym mene Corporation has a systematic process in place to evaluate and determine the materiality of corporate responsibility topics. Materiality analysis is updated peri odically. We recommend that the Company continues to further develop proactive dialogue with its stakeholders to determine and evaluate material topics.

selected depend on the practitioner’s judgement, including an assessment of the risks of material misstatement of the CR Reporting and an assessment of the risks of the Company’s material nonadherence to the AA1000 AccountAbility Principles. Our work consisted of, amongst others, the following procedures: • Interviewing senior management of the Company. • Interviewing employees from various organisational levels of the Company with regards to materiality, stakeholder expectations, meeting of those expecta tions, as well as stakeholder engagement. • Assessing stakeholder inclusivity and responsiveness based on the Company’s documentation and internal communi cation. • Assessing the Company’s defined mate rial corporate responsibility topics as well as assessing the CR Reporting based on these topics. • Visiting the Company’s Head Office as well as two sites in Finland and Germany. Visits were conducted virtually. • Interviewing employees responsible for collecting and reporting the information presented in the CR Reporting at the group level as well as at the site level. • Assessing how group employees apply the reporting instructions and procedures of the Company. • Testing the accuracy and completeness of the information from original documents and systems on a sample basis. • Testing the consolidation of informa tion and performing recalculations on a sample basis. Limited assurance conclusion Based on the procedures we have per formed and the evidence we have obtained, nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation’s CR Reporting for the report ing period ended 31 December 2020 is not properly prepared, in all material respects, in accordance with the Reporting criteria,

Independent Practitioner’s Assurance Report

UPM’S CORPORATE RESPONSIBILITY REPORTING IN ACCORDANCE WITH GRI STANDARDS AND AA 1000 UPM follows the Global Reporting Initiative’s (GRI) Sustainability Reporting Standards in its corporate responsibility reporting. The reporting has been prepared in accordance with the GRI Standards: Core option. Our GRI index document shows where the disclosures of material topics and general disclosures are addressed in the Annual Re port, on UPM’s webpage or in the GRI index document itself. It also includes information on omissions, additional explanations and disclosures on the management approach. The document is available on the UPM web page upm.com/responsibility. UPM is also committed to the principles of inclusivity, materiality and responsiveness as defined in the AA 1000 AccountAbility Principles Standard (2008). The English version of the corporate responsi bility information for 2020 has been assured by an independent third party, Pricewater houseCoopers Oy (see the Independent Assurance Report below) and identified in the GRI content index. Congruence between the English and Finnish version has been checked.

To the Management of UPM-Kymmene Corporation We have been engaged by the Man agement of UPM-Kymmene Corporation (hereinafter also “the Company”) to perform a limited assurance engagement on selected corporate responsibility informa tion for the reporting period 1 January to 31 December 2020, disclosed in UPM-Kym mene Corporation’s Annual Report 2020 and on its website in section “Responsi bility” (hereinafter “the CR Reporting”). The assured information is indicated in the Company’s GRI Content Index 2020 on the Company’s website. Furthermore, the assurance engagement has covered UPM-Kymmene Corporation’s adherence to the AA1000 AccountAbility Principles withmoderate (limited) level of assurance. Management’s responsibility The Management of UPM-Kymmene Cor poration is responsible for preparing the CR Reporting in accordance with the Reporting criteria as set out in the Company’s report ing instructions and the GRI Standards Sustainability Reporting Guidelines of the Global Reporting Initiative. The Manage ment of UPM-Kymmene Corporation is also responsible for such internal control as the management determines is necessary to enable the preparation of CR Reporting that is free frommaterial misstatement, whether due to fraud or error. The Management of UPM-Kymmene Corporation is also responsible for the Company’s adherence to the AA1000 AccountAbility Principles of inclusivity, materiality and responsiveness as set out in AccountAbility’s AA1000 AccountAbility Principles Standard 2008.

Practitioner’s responsibility Our responsibility is to express a limited assurance conclusion on the CR Reporting and on the Company’s adherence to the AA1000 AccountAbility Principles based on the procedures we have performed and the evidence we have obtained. We conducted our limited assurance engagement in accordance with the International Standard on Assurance Engagements (ISAE) 3000 (Revised) “Assurance Engagements Other than Audits or Reviews of Historical Finan cial Information”. That Standard requires that we plan and perform the engagement to obtain limited assurance about whether the CR Reporting is free frommaterial misstatement. In addition, we have conducted our work in accordance with the AA1000 Assurance Standard 2008. For conducting a Type 2 assurance engagement as agreed with the Company, the AA1000AS (2008) requires planning and performing of the assurance engagement to obtain moderate (limited) assurance on whether any matters come to our attention that cause us to believe that UPM-Kymmene Corporation does not adhere, in all material respects, to the AA1000 AccountAbility Principles and that the CR Reporting is not reliable, in all material respects, based on the Reporting criteria. In a limited assurance engagement, the evidence-gathering procedures are more limited than for a reasonable assurance engagement, and therefore less assurance is obtained than in a reasonable assurance engagement. An assurance engagement involves performing procedures to obtain evidence about the amounts and other disclosures in the CR Reporting, and about the Company’s adherence to the AA1000 AccountAbility Principles. The procedures

Helsinki 18 February 2021 PricewaterhouseCoopers Oy

Mikko Nieminen Partner Authorised Public Accountant

Jussi Nokkala Director Sustainability & Climate Change

114

115

UPM ANNUAL REPORT 2020

UPM ANNUAL REPORT 2020