UPM Annual Report 2021

GOVERNANCE

UPM

BEYOND FOSSILS

STRATEGY

BUSINESSES

RESPONSIBILITY

ACCOUNTS FOR 2021

Regarding Inclusivity : UPM-Kymmene Corporation has processes in place for stake holder inclusivity both at the group and at the business level. Due to recent investment op erations inUruguay and Germany additional stakeholder expectations and needs have been considered. We recommend that the Company continues continuous monitoring of changes across stakeholder expectations through established procedures to ensure inclusivity of stakeholders. Regarding Materiality : UPM-Kymmene Corporation has a systematic process in place to evaluate and determine themateriality of corporate responsibility topics. Materiality analysis is updated periodically. The compa ny has also considered the financial impacts of the climate change. We recommend that the Company continues to elaborate and update its material aspects also from the viewpoint of the financial materiality. Regarding Responsiveness : UPM-Ky mmene Corporation has processes in place for responding to stakeholder needs. Introduction of green finance required adjustment in the responsiveness towards stakeholder expectations. We recommend that the Company maintains its systematic approach to respond to stakeholder's expec tations and considers the increased green finance related stakeholder needs. Regarding Impact : UPM-Kymmene Cor poration has a process in place tomonitor and measure the economic, environmental and social impacts of its business activities. Bio diversity is recognised as one of thematerial impact topics andmethodology tomeasure biodiversity impact are a further developing area. We recommendUPMto continue sys tematic development of biodiversity impact measurement and related disclosures.

• Assessing the Company’s defined ma terial corporate responsibility topics as well as assessing the related information based on these topics. • Performing a media analysis and an inter net search for references to the Company during the reporting period. • Testing the accuracy and completeness of the information from original documents and systems on a sample basis. • Testing the consolidation of informa tion and performing recalculations on a sample basis. • Considering the disclosure and presenta tion of the CR Reporting. Limited assurance conclusion Based on the procedures we have per formed and the evidence we have obtained, nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation’s CR Reporting for the report ing period ended 31 December 2021 is not properly prepared, in all material respects, in accordance with the Reporting criteria. Furthermore nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation does not ad here, in all material respects, to the AA1000 AccountAbility Principles. When reading our limited assurance report, the inherent limitations to the accuracy and completeness of corporate responsibility information should be taken into consideration. Our assurance report has been pre pared in accordance with the terms of our engagement. We do not accept, or assume responsibility to anyone else, except to UPM-Kymmene Corporation for our work, for this report, or for the conclusions that we have reached. Observations and recommendations Based on the procedures we have per formed and the evidence we have obtained, we provide the following observations and recommendations in relation to UPM-Ky mmene Corporation’s adherence to the AA1000 AccountAbility Principles (2018). These observations and recommendations do not affect the conclusions presented above.

the CR Reporting is free frommaterial misstatement. In addition, we have conducted our work in accordance with the AA1000 Assurance Standard 2018. For conducting a Type 2 assurance engagement as agreed with the Company, the AA1000AS (2018) requires planning and performing of the assurance engagement to obtain moderate (limited) assurance on whether any mat ters come to our attention that cause us to believe that UPM-Kymmene Corporation does not adhere, in all material respects, to the AA1000 AccountAbility Principles and that the CR Reporting is not reliable, in all material respects, based on the Reporting criteria. In a limited assurance engagement, the evidence-gathering procedures are more limited than for a reasonable assurance engagement, and therefore less assurance is obtained than in a reasonable assurance engagement. An assurance engagement involves performing procedures to obtain evidence about the amounts and other information in the CR Reporting, and about the Company’s adherence to the AA1000 AccountAbility Principles. The procedures Selected depend on the practitioner’s judgment, including an assessment of the risks of material misstatement of the CR Reporting and an assessment of the risks of the Company's material nonadherence to the AA1000 AccountAbility Principles. Our work consisted of, amongst others, the following procedures: • Interviewing representatives of senior management of the Company. • Visiting the Company’s Head Office as well as two sites in Finland. • Interviewing employees responsible for collecting and reporting the selected information on responsibility indicators at the Group level. • Interviewing employees from various or ganisational levels of the Company with regards to materiality, stakeholder expec tations, meeting of those expectations, as well as stakeholder engagement. • Assessing stakeholder inclusivity and responsiveness based on the Company’s documentation and internal communi cation.

UPM’S CORPORATE RESPONSIBILITY REPORTING IN ACCORDANCE WITH GRI STANDARDS AND AA 1000

Independent practitioner’s limited assurance report on UPM’s Corporate Responsibility reporting

To the Management of UPM-Kymmene Corporation We have been engaged by the Man agement of UPM-Kymmene Corporation (hereinafter also the “Company”) to perform a limited assurance engagement on selected corporate responsibility infor mation for the reporting period 1 January 2021 to 31 December 2021, disclosed in UPM-Kymmene Annual Report 2021 and on its website in section “Responsibility” (hereinafter “CR Reporting”). The assured information is indicated in the Company’s GRI Content Index 2021 on the Company’s website. Furthermore, the assurance engagement has covered UPM-Kymmene Corporation’s adherence to the AA1000 AccountAbility Principles with moderate (limited) level of assurance. Management’s responsibility The Management of UPM-Kymmene Corporation is responsible for preparing the CR Reporting in accordance with the Reporting criteria as set out in UPM-Kym mene Corporation reporting instructions described in UPM-Kymmene Corporation’s Annual Report 2021 and GRI Standards Sustainability Reporting Guidelines of the Global Reporting Initiative. The Management of UPM-Kymmene Corporation is also responsible for the Company’s adherence to the AA1000 Ac countAbility Principles of inclusivity, mate riality, responsiveness and impact as set out in AccountAbility’s AA1000 AccountAbility Principles Standard 2018. The Management of UPM-Kymmene Corporation is also responsible for such internal control as the management deter mines is necessary to enable the prepara tion of the CR Reporting that is free from material misstatement, whether due to fraud or error.

Practitioner’s independence, other ethi cal requirements and quality control We have complied with the independence and other ethical requirements of the In ternational Code of Ethics for Professional Accountants (including International Independence Standards) issued by the International Ethics Standards Board for Accountants (IESBA Code), which is found ed on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behavior. Our multi-disciplinary teamof corporate responsibility and assurance specialists possesses the requisite skills and experience within financial and non-financial assurance, corporate responsibility strategy andman agement, social and environmental issues, as well as the relevant industry knowledge, to undertake this assurance engagement. PricewaterhouseCoopers Oy applies International Standard on Quality Control 1 and accordinglymaintains a comprehensive systemof quality control including docu mented policies and procedures regarding compliance with ethical requirements, pro fessional standards and applicable legal and regulatory requirements. Practitioner’s responsibility Our responsibility is to express a limited assurance conclusion on the CR Reporting and on the Company’s adherence to the AA1000 AccountAbility Principles based on the procedures we have performed and the evidence we have obtained. We conduct ed our limited assurance engagement in accordance with the International Standard on Assurance Engagements (ISAE) 3000 (revised) “ Assurance Engagements Other than Audits or Reviews of Historical Finan cial Information ”. This Standard requires that we plan and perform the engagement to obtain limited assurance about whether

UPM follows the Global Reporting Initiative’s (GRI) Sustainability Reporting Standards in its corporate responsibility reporting. The reporting has been prepared in accordance with the GRI Standards: Core option. Our GRI index document shows where the disclosures of material topics and general disclosures are addressed in the Annual Re port, on UPM’s webpage or in the GRI index document itself. It also includes information on omissions, additional explanations and disclosures on the management approach. The document is available on the UPM web page www.upm.com/responsibility. UPM is also committed to the principles of inclusivity, materiality, responsiveness and impact as defined in the AA 1000 Account Ability Principles Standard (2018). The English version of the corporate responsibility information for 2021 has been assured by an independent third party, PricewaterhouseCoopers Oy (see the Independent Assurance Report on the right) and identified in the GRI content index. Congruence between the English and Finnish version has been checked.

Helsinki 18 February 2022 PricewaterhouseCoopers Oy Authorised Public Accountants

Tiina Puukkoniemi Partner, Authorised Public Accountant (KHT) Sustainability Assurance and Reporting Lead Mikko Nieminen Partner, Authorised Public Accountant (KHT) Lead Financial Audit Partner

116

117

UPM ANNUAL REPORT 2021

UPM ANNUAL REPORT 2021