UPM Annual Report 2022

GOVERNANCE

UPM

BEYOND FOSSILS

BUSINESSES

RESPONSIBILITY

ACCOUNTS FOR 2022

Regarding Inclusivity: UPM-Kymmene Corporation has processes in place for stakeholder inclusivity both at the group and at the business level. During 2022 UPM has completed two voluntary compa ny-wide salary reviews, first eliminating unexplained gender pay gaps and second defining the minimum income necessary for a worker to meet their basic needs. We encourage UPM to continue its aim to be an employer that offers fair pay and equal career opportunities for all. Regarding Materiality: UPM-Kym mene Corporation has a systematic process in place to evaluate and determine the materiality of corporate responsibility topics. Materiality analysis has been updat ed to reflect the updated GRI standard to better reflect the assessment of impact. We recommend that the Company continues to update its materiality assessment process and prepares for the Corporate Sustain ability Reporting Directive requirements of materiality assessment. Regarding Responsiveness: UPM-Ky mmene Corporation has processes in place for responding to stakeholder needs. Collec tive bargaining agreement negotiations in 2022 required adjustment and responsive ness towards stakeholder expectations. We recommend that the Company continues to develop its systematic approach to respond to stakeholder's expectations. Regarding Impact: UPM-Kymmene Corporation has a process in place to mon itor and measure the economic, environ mental and social impacts of its business activities. Biodiversity has been assessed as an area of high impact and the company has set a target to continuously develop bio diversity reporting. We recommend UPM to continue the systematic development of impact assessment and related disclosures. Helsinki 17 February 2023 PricewaterhouseCoopers Oy Tiina Puukkoniemi Partner, Authorised Public Accountant (KHT) ESG Reporting & Assurance Mikko Nieminen Partner, Authorised Public Accountant (KHT) Lead Financial Audit Partner

Audits or Reviews of Historical Financial Information” and, in respect of greenhouse gas emissions, International Standard on Assurance Engagements (ISAE) 3410 “Assurance Engagements on Greenhouse Gas Statements” . These standards require that we plan and perform the engagement to obtain limited assurance about whether the CR Reporting is free from material misstatement. In addition, we have conducted our work in accordance with the AA1000 Assur ance Standard v3. For conducting a Type 2 assurance engagement as agreed with the Company, the AA1000ASv3 requires planning and performing of the assurance engagement to obtain moderate (limited) assurance on whether any matters come to our attention that cause us to believe that UPM-Kymmene Corporation does not ad here, in all material respects, to the AA1000 AccountAbility Principles and that the CR Reporting is not reliable, in all material respects, based on the Reporting criteria. In a limited assurance engagement, the evidence-gathering procedures are more limited than for a reasonable assurance engagement, and therefore less assurance is obtained than in a reasonable assurance engagement. An assurance engagement involves performing procedures to obtain evidence about the amounts and other information in the CR Reporting, and about the Company’s adherence to the AA1000 AccountAbility Principles. The procedures Selected depend on the practitioner’s judgment, including an assessment of the risks of material misstatement of the CR Reporting and an assessment of the risks of the Company's material nonadherence to the AA1000 AccountAbility Principles. Our work consisted of, amongst others, the following procedures: • Interviewing of senior management of the Company. • Visiting the Company’s Head Office as well as two sites in Europe. • Interviewing employees responsible for collecting and reporting the selected information on responsibility indicators at the Group level. • Interviewing employees from various or ganisational levels of the Company with regards to materiality, stakeholder expec tations, meeting of those expectations, as well as stakeholder engagement.

• Assessing stakeholder inclusivity and re sponsiveness based on the Company’s docu mentation and internal communication. • Assessing the Company’s defined ma terial corporate responsibility topics as well as assessing the related information based on these topics. • Performing a media analysis and an inter net search for references to the Company during the reporting period. • Testing the accuracy and completeness of the information from original documents and systems on a sample basis. • Testing the consolidation of informa tion and performing recalculations on a sample basis. • Considering the disclosure and presenta tion of the CR Reporting. Limited assurance conclusion Based on the procedures we have per formed and the evidence we have obtained, nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation’s CR Reporting for the report ing period 1 January 2022 to 31 Decem ber 2022 is not properly prepared, in all material respects, in accordance with the Reporting criteria. Furthermore nothing has come to our attention that causes us to believe that UPM-Kymmene Corporation does not ad here, in all material respects, to the AA1000 AccountAbility Principles. When reading our limited assurance report, the inherent limitations to the accuracy and completeness of corporate responsibility information should be taken into consideration. Our assurance report has been pre pared in accordance with the terms of our engagement. We do not accept, or assume responsibility to anyone else, except to UPM-Kymmene Corporation for our work, for this report, or for the conclusions that we have reached. Observations and recommendations Based on the procedures we have performed and the evidence we have obtained, we pro vide the following observations and recom mendations in relation to UPM-Kymmene Corporation’s adherence to the AA1000 AccountAbility Principles (2018). These observations and recommendations do not affect the conclusions presented above.

Independent practitioner’s limited assurance report on UPM’s Corporate Responsibility reporting

UPM’S CORPORATE RESPONSIBILITY REPORTING IN ACCORDANCE WITH GRI STANDARDS AND AA 1000 UPM has reported in accordance with the Global Reporting Initiative’s (GRI) Stan dards for the period 1 January 2022 to 31 December 2022. Our GRI index document shows where the disclosures of material topics and general disclosures are addressed in the Annual Re port, on UPM’s webpage or in the GRI index document itself. It also includes information on omissions, additional explanations, and disclosures on the management approach. The document is available on the UPM web page www.upm.com/responsibility. UPM is also committed to the principles of inclusivity, materiality, responsiveness, and impact as defined in the AA 1000 Account Ability Principles Standard (2018). The English version of the corporate responsibility information for 2022 has been assured by an independent third party, PricewaterhouseCoopers Oy (see the Independent Assurance Report on the right) and identified in the GRI content index. Congruence between the English and Finnish version has been checked.

To the Management of UPM-Kymmene Corporation We have been engaged by the Man agement of UPM-Kymmene Corporation (hereinafter also the “Company”) to perform a limited assurance engagement on selected corporate responsibility infor mation for the reporting period 1 January 2022 to 31 December 2022, disclosed in UPM-Kymmene Annual Report 2022 and on its website in section “Responsibility” (hereinafter “CR Reporting”). Selected corporate responsibility information The selected corporate responsibility information within the scope of assurance covers: • The economic, social and environmental corporate responsibility indicators as identified in the GRI Content Index 2022 on the Company’s website. • UPM-Kymmene Corporation’s adherence to the AA1000 AccountAbility Principles (2018). Management’s responsibility The Management of UPM-Kymmene Corporation is responsible for preparing the CR Reporting in accordance with the Reporting criteria as set out in UPM-Kym mene Corporation reporting instructions described in UPM-Kymmene Corporation’s Annual Report 2022 and GRI Standards of the Global Reporting Initiative. The Management of UPM-Kymmene Corporation is also responsible for the Company’s adherence to the AA1000 Ac countAbility Principles of inclusivity, mate riality, responsiveness and impact as set out in AccountAbility’s AA1000 AccountAbility Principles Standard 2018. The Management of UPM-Kymmene Corporation is also responsible for such internal control as the management deter mines is necessary to enable the prepara

tion of the CR Reporting that is free from material misstatement, whether due to fraud or error. Practitioner’s independence, other ethical requirements and quality control We have complied with the independence and other ethical requirements of the International Code of Ethics for Profession al Accountants (including International Independence Standards) issued by the International Ethics Standards Board for Accountants (IESBA Code), which is found ed on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behavior. Our multi-disciplinary team of corpo rate responsibility and assurance specialists possesses the requisite skills and experi ence within financial and non-financial assurance, corporate responsibility strategy and management, social and environmen tal issues, as well as the relevant industry knowledge, to undertake this assurance engagement. PricewaterhouseCoopers Oy applies International Standard on Quality Control (ISQC) 1 and accordingly maintains a com prehensive system of quality control includ ing documented policies and procedures regarding compliance with ethical require ments, professional standards and applica ble legal and regulatory requirements. Practitioner’s responsibility Our responsibility is to express a limited assurance conclusion on the CR Reporting and on the Company’s adherence to the AA1000 AccountAbility Principles based on the procedures we have performed and the evidence we have obtained. We conducted our limited assurance engagement in accor dance with the International Standard on Assurance Engagements (ISAE) 3000 (re vised) “Assurance Engagements Other than

116

117

UPM ANNUAL REPORT 2022

UPM ANNUAL REPORT 2022