UPM Annual Report 2020

Management of non-financial matters UPM’s responsibility thinking starts with anticipating, mitigating and managing risks, and extends to creating a competitive advantage and long-term value. UPM continually strives to reduce its risk exposure and improve its performance by using tools such as certified management systems. Since 2018, all our production sites have a certified ISO 14001 environmental management system. Almost all our production sites and wood-sourcing operations implemented integrated management systems for environmental protection, quality management and occupational health and safety in accordance with ISO 14001, ISO 9001 and ISO 45001 standards. All European pulp and paper mills, as well as the UPM Fray Bentos pulp mill in Uruguay and the UPM Changshu paper mill in China, also adhere to the EU’s Eco-Management and Audit Scheme (EMAS). Many of the sites also have energy management systems certified under ISO 50001 or the Finnish ETJ+ system, and food safety management systems certified under ISO 22000, if relevant. Should stakeholders have any concerns or suspect misconduct, they are encouraged to contact UPM or to use the UPM Report Misconduct channel which was renewed in 2020. The new service is available on the corporate website for both the company’s employees and external stakeholders. Operated by an independent external service provider, the service is accessible in over 40 languages, 24/7. In 2020, 23 (31) cases were reported either through the UPM Report Misconduct channel or directly to internal audit. One case related to discrimination. Five cases led to disciplinary action including warnings and terminations of employment. Reporting framework used UPM uses the GRI Standards reporting guidelines published by the Global Reporting Initiative to measure and report on corporate responsibility at group level. UPM’s corporate responsibility reporting has been compiled in accordance with the GRI Standards: Core option. Committed to anti-corruption The UPM Code of Conduct underlines the company’s zero tolerance attitude towards corruption and bribery in any form. UPM Anti Corruption Rules explain prohibited conduct and expected ethical behaviour in further detail. UPM performs anti-corruption risk assessment on a regular basis. The annual risk-assessment process includes a top-down risk discussion with the management of each business area. All UPM group entities are also assessed on the basis of country risk and complexity of operations. UPM operates globally and has significant manufacturing operations in several emerging market countries. Such operations require a number of permits and other licenses from the relevant authorities. Some of the countries where UPM operates are perceived as highly corrupt or corrupt according to Transparency International. In these countries, there is an increased risk of corruption, for example in relation to interaction with government officials and in the use of intermediaries when applying for permits and licences requiring governmental approval. Due diligence of suppliers and third parties with whom UPM does business is an essential part of UPM’s anti-corruption compliance programme. UPM requires that due diligence is performed before entering into or renewing any contract with a third party that meets specified criteria. UPM requires anti-bribery contract terms to be included in agreements with such third parties outlining the third party’s commitment to compliance with applicable anti-bribery laws and UPM’s right to audit the third party to verify compliance with these terms. The company also has corresponding due diligence procedures for joint ventures, including mergers and acquisitions.

The UPM Code of Conduct is complemented by more detailed policies approved by the Board of Directors and rules or statements approved by the Group Executive Team, business areas or global functions. These policies, rules and statements cover such topics as treasury, taxes, disclosures, insider matters, anti-corruption, competition law, confidentiality, contract management, human resources, the environment, forestry, information security and data protection, and safety. In 2020, the UPM Responsibility Statement, defining responsibility-related principles and commitments relevant to all UPM operations, was issued UPM requires its suppliers, third party intermediaries and joint venture partners to apply the same principles as in the UPM Code of Conduct and to fulfil criteria concerning social and environmental responsibility. These requirements are defined in the UPM Supplier and Third Party Code, latest updates effective as of beginning of 2020. The UPM Code of Conduct was last updated during 2019, followed by extensive communication and training efforts to enhance our employees' awareness and understanding of its contents. Roles of the group management and functions in leading non financial matters The Board of Directors, with the assistance of the Audit Committee, is responsible for monitoring compliance with applicable legal and regulatory requirements and with the UPM Code of Conduct and other corporate policies. In addition, the Audit Committee oversees procedures for treatment of complaints and concerns received by the company, anonymous or otherwise. As part of the committee’s compliance review, the committee is provided with a quarterly report by the company’s Chief Compliance Officer, and a report of submissions under the company’s Report Misconduct channel by the Head of Internal Audit. In line with its main duties and responsibilities, the Board reviewed and approved updated strategic plans during its strategy session in May 2020. The main focus areas of the UPM Biofore strategy continue to be performance, growth, innovation, responsibility and portfolio development. This strategy is enhanced by the brand promise: Beyond Fossils (read more on pages 26-27). An essential part of the Board’s annual strategy work is to review and assess strategic and operational risks and opportunities (see UPM Governance Statement 2020). These risks and opportunities and their impact on operations and strategy are described on pages 36-37. The Group Executive Team, headed by the President and CEO, is in charge of the management of corporate responsibility, determining courses of action and guiding development work. In practice, corporate responsibility efforts take place in businesses and functions, and in the Group’s Responsibility team, which co-ordinates the projects carried out by businesses and functions. UPM Legal Function and its Compliance team manage legal compliance programmes and arrange related training at regular intervals for specific target groups, which have been defined based on risk assessments. UPM Sourcing organisations follow clearly defined selection and follow-up processes when evaluating suppliers. Reliable long-term deliveries, product and service quality, financial sustainability of suppliers, social and environmental responsibility and product safety are the key factors when selecting and evaluating suppliers. While executing strategies, UPM and its business areas, functions and production units are exposed to a number of financial and non financial risks and opportunities. Each business area, function and unit is responsible for identifying, measuring and managing risks related to its own operations, and for reporting on risk exposures, risk management activities and results to its own management team and to the Risk Management Function.

In 2020, UPM updated its anti-corruption e-learning platform. The anti-corruption training covers all white-collar employees. In 2020, the company also launched an e-learning platform to support the implementation of the updated Supplier and Third Party Code. The company organized tailored anti-corruption training workshops for selected target groups across the company and performed risk-based compliance reviews in selected jurisdictions and operations. Respect for human rights UPM is committed to respecting human rights. UPM has assessed all its operations and activity and has identified the potential human rights issues and impacts. When considering both the severity and likelihood of these potential issues and impacts, UPM considers the salient human rights issues in the company’s sphere of influence to be environmental pollution, occupational health and safety (OHS), working conditions, protection of children, and forced labour. In 2020, UPM reviewed quarterly its human rights risks as part of UPM compliance process and took into use a continuous process for assessing salient human rights issues on a business area level. Grievance mechanisms were strengthened by renewing UPM’s Report Misconduct channel. Responsible sourcing UPM requires its suppliers, third-party intermediaries and joint venture partners to apply the same principles as in the UPM Code of Conduct including commitment to anti-corruption, environmental and social responsibility, safe products, human rights and occupational health and safety practices. Transparent supplier requirements are the basis for responsible sourcing. These supplier requirements are defined in the UPM Supplier and Third Party Code (available on the corporate website). A number of additional requirements are in place for the sourcing of wood, chemicals, pulp and packaging materials, as well as for safety and logistics. All contractors working on site go through UPM’s safety requirements and a web-based safety induction training. UPM identifies its supply chains with a high risk of potential negative environmental and social impacts. These responsibility-related risks are determined by the country of origin, sourced material or service, and complexity of supply chain. Based on the risk identification, selected suppliers’ activities are evaluated in more detail through EcoVadis and other assessments, supplier audits and joint development plans. In 2020, UPM focused on training its sourcing employees on renewed supplier requirements and promoting decent work in supply chain. UPM also assessed working conditions in its logistics chain by interviewing truck drivers in Central-Europe. UPM continued its cooperation with Together for Sustainability (TfS), a chemical industry initiative that promotes and improves sustainability practices within the supply chains and its participation to UN Global Compact Action Platform on Decent Work in Global Supply Chains. In 2020, UPM conducted some 290 EcoVadis assessments and 117 supplier audits. Social and employee-related matters UPM’s responsibility focus areas in social and employee-related matters are: learning and development, responsible leadership, diversity and inclusion as well as working conditions. UPM is committed to active employee participation and consultation, organised in accordance with international and national rules and regulations. UPM aims to empower and engage employees at all levels through responsible leadership. UPM encourages its employees to pursue professional growth, expects development and supports them in learning skills and developing them further.

UPM respects the privacy of employees and promotes equal opportunities and objectivity in employment and career development. All UPM employees are treated as individuals regardless of gender, age, ethnic origin, nationality, etc. UPM promotes employees' health and wellbeing. Safety is an essential part of UPM’s activities and business management system. Equal safety requirements are applied to all employees, visitors and contractors working at UPM’s premises. In its People Strategy, UPM focused on leadership and creating safe, inclusive & diverse working environment, as well as aiming higher in performance and ensuring growth of our people. In 2020, UPM continued the enabling performance approach by strengthening feedback culture, agile goal setting and frequent manager-employee discussions. Development programs to support skills of asking and giving feedback, high quality conversations and coaching have been continued. To further develop inclusive leadership and culture, UPM continued the dialogue on diversity and inclusion with management teams. The proactive safety of employees and contractors has remained an important focus area in 2020. Safety and wellbeing of our employees during global pandemic has been the key priority . Product stewardship Majority of UPM’s products are made from renewable raw materials and are recyclable. Product stewardship covers the entire lifecycle of all UPM products from the development phase to the end-use and beyond. Ecodesign and product safety measures ensure that impacts on products and the environment are considered and minimised. In 2020, UPM renewed its sustainable product design concept. One step was the updating of the ecodesign questionnaire to cover the UN Sustainable Development Goals. UPM provides product declarations to provide customers with easy access to information concerning the responsibility of products' environmental and product safety aspects or the wood origin. In 2020, the collaboration with paper and chemical companies resulted in a new harmonized and transparent way to gather and assess chemical information. Most of UPM products are certified with widely recognised ecolabels, such as the EU ecolabel and national ecolabels for graphic paper or ISCC and RSB certification for biofuels, biocomposites and labels. All of UPM pulp mills, the European sites of UPM Raflatac and UPM Specialty Papers' production lines have implemented ISO 22000 food management systems and the respective products are designed and produced to meet food packaging requirements. Environment UPM’s responsibility focus areas in environmental matters are forests and biodiversity, water use, waste and climate. UPM uses raw materials, water, energy and other resources in a responsible manner and continuously improves its energy, resource and cost efficiency. UPM is committed to sustainable forestry, and the company uses third-party-verified FSC™ and PEFC chain of custody certification to ensure that the wood it procures is legally sourced from sustainably managed forests. All UPM owned forests are certified, or in the process of certification if acquired recently. In 2020, UPM continued to implement its work aimed at positive impact on biodiversity in company forests in Finland. This biodiversity programme is implemented through biodiversity guidelines for operational forestry work, forest protection and cooperation with stakeholders. Biodiversity indicators and monitoring methods have been developed further in 2020.

134

UPM ANNUAL REPORT 2020 UPM FINANCIAL REPORT 2020 19 135

UPM ANNUAL REPORT 2020

UPM FINANCIAL REPORT 2020 18