UPM Annual Report 2020

Our e-learning modules are available on the same HR platform and easily accessible for our employees. This platform allows us to manage our training effectively through automated reminders and escalation processes, and we can also easily produce training reports. During the year, the com pletion of mandatory compliance e-learn ings was set as a prerequisite for short-term incentive payments. This new criterion will be applied for the first time in incentive payments for 2020 in spring 2021. Available compliance e-learning with the completion rates at year end are listed in the table on the next page. The e-learning modules are com plemented via face-to-face compliance training with specific target groups, who are determined based on risk assessments. The compliance training sessions are supported by active communication. Given that our employees’ awareness of what is expected from them is a prerequisite for compliance, we continue to allocate further resources to this. Monitoring Our group company riskmatrix, which is based on country risk and complexity and the extent of our operations in each country, forms the basis for monitoring activities aimed at ensuring compliance at all levels of the organisation. Our compliance teamhas a three-year monitoring plan for its compli ance reviews that is based on this matrix. The reviews to be performed each year are agreed with the businesses during the annual risk assessment process and co-ordinated with the Internal Audit department. The compli ance review findings and recommendations are reported to the Audit Committee of the Board of Directors and businesses. These recommendations are then carried out in collaboration with said businesses. In 2020, the compliance team conducted compliance reviews in 20 local units in South America, Asia and Europe. Due to COVID-19 most reviews were conducted remotely. Another example of our compliance team’s monitoring activity is the counter party screening procedures demonstrated in the illustration on the right. The purpose of the activity is to manage compliance risks relating to our numerous business partners in different countries and continents. We

they can trust UPM to take the appropriate action. If we are worried about anything, we must speak up and take action. In 2020, we updated our Report Mis conduct channel (read more on the right). We do not tolerate retaliation against any person who, in good faith, reports suspected misconduct or participates in an investiga tion to resolve suspected misconduct.

provides examples of cases handled. Five cases led to disciplinary action, including warnings and terminations of employment.

The table on the right summarises the number of cases recorded in our miscon duct case management system in 2020 and

want to know who we are trading with and to source even more responsibly. We also want to be able to manage uncertainties relating to trade sanctions more effectively. Voicing concerns It is an important part of our culture of integrity that employees feel comfortable voicing any concerns they have and that

OUR MAIN PRINCIPLES UNDER THE UPM CODE OF CONDUCT

We are committed to integrity

We respect people and human rights

We take care of our environmental impact and product safety

REPORTED CASES UNDER REPORT MISCONDUCT CHANNEL UPM Code of Conduct section

2020

2019

Our commitment on integrity Our people and operations Respect people and human rights

1

1

We have zero-tolerance for corruption and bribery

4 1

20

COMPLIANCE MONITORING

Taking care of the environmental impact and product safety

2

We avoid conflicts of interest

Business integrity Zero-tolerance for corruption and bribery

REGULAR DISCUSSIONS WITH MANAGEMENT , monitoring significant projects, training rate monitoring, implementation of risk mitigation plan

3 7 2 3

3 1 1 2

We comply with competition law

Avoid conflicts of interest

Compliance with competition laws Protect assets and information

We protect our assets and information

REGULAR COMPLIANCE REVIEWS based on group

Our stakeholders Know with whom you trade

We know with whom we trade

2

1

UPM BUSINESS AREAS AND OTHER OPERATIONS

Total

23

31

We engage with our stakeholders and society

company risk matrix

We voice our concerns

REGULAR DISCUSSIONS WITH EMPLOYEES , third party due diligence and risk monitoring, reports through UPM Report Misconduct channel, EES and other employee surveys

COMPLIANCE TRAINING FOR SPECIFIC TARGET GROUPS IN 2020

COMPLETION RATES AS OF 31 DECEMBER 2020

SIZE OF TARGET GROUP

99

18,000 7,130 7,130 3,200 7,130

Code of Conduct e-learning

100

Personal data protection e-learning

97 97 96 95

Anti-Corruption e-learning Competition law e-learning Confidentiality e-learning Insider Policy e-learning

110

COUNTERPARTY SCREENING PROCEDURES

•Business partner screening against public sources •Business integrity (trade sanctions, anti-corruption, anti-money laundering, competition law, fraud)

•Human rights •Environment •Supply chain risk assessments

CASE

NEW CHANNEL FOR VOICING CONCERNS

and the Chief Compliance Officer at UPM. They will then, in most cases, assign responsibility for the next steps to the most appropriate person. The new service establishes efficient procedures for managing the reported cases inside UPM in a way that meets the requirements of the EU Whistleblower Protection Directive. In previous years, the number of misconduct reports received has been at the level of around 30 cases annually. The number should likely be higher in a company of our size and is expected to rise with the introduction of the new channel. We welcome all input also from customers and partners on any suspicions of misconduct, as stakeholders play a crucial role in maintaining the UPM standards of integrity.

Low risks

UPM business partner portfolio

At UPM, everyone is responsible for maintaining our integrity and ethical standards. We want to promote a culture of raising concerns openly among colleagues and supervisors or reach ing out to HR or other assurance functions. The reporting channel offers another way of voicing concerns. Also, if an employee suspects a breach has occurred, it is important not to assume that someone else has already reported it and promptly report any misconduct. Our Report Misconduct channel was renewed in 2020. A new service is available globally on our website for both employees and all stakeholders. Operated by an independent external service

Mitigating identified risks

Avoiding high risks

PREVENT •Supplier qualification •Supplier and Third-Party Code •Specific requirements •Enhanced due diligence on selected business partners •Onboarding and contracting process

MONITOR •Supplier audits and corrective action plans •Supplier assessments

REACT •Incident analysis and investigation •Blocking procedure •Contract termination

provider, the service is accessible in over 40 languages, 24/7. All reports coming in through the channel are made available to the Head of Internal Audit

78

79

UPM ANNUAL REPORT 2020

UPM ANNUAL REPORT 2020