UPM Annual Report 2022

RESPONSIBILITY

UPM

BEYOND FOSSILS

BUSINESSES

GOVERNANCE

ACCOUNTS FOR 2022

Monitoring We aim to ensure compliance at all levels of the organisation through monitoring. Our monitoring activities are based on a group company risk matrix that considers the country risk and complexity and the extent of our operations in each country. Our compliance team has a three-year monitoring plan for its unit-specific compli ance reviews that are based on this matrix. On top of these general reviews covering all business integrity topics, we conduct risk based reviews around specific topics such as competition law or anti-corruption. The reviews to be performed each year are agreed with the businesses during the annual risk assessment process and coor dinated with the Internal Audit. The most important compliance review findings and recommendations are reported to the Audit Committee of the Board of Directors and businesses. These recommendations are then carried out in collaboration with said businesses. In 2022, the compliance team conduct ed compliance reviews in 16 local units or operations in the Americas, the Asia-Pacific region and Europe. Due to the COVID-19 pandemic some reviews were still conduct ed remotely. Another example of our com pliance team’s monitoring activity is the counterparty screening procedures shown in the illustration on the right.

COMPLIANCE MONITORING

REGULAR DISCUSSIONS WITH MANAGEMENT , monitoring significant projects, training rate monitoring, implementation of risk mitigation plan

REGULAR COMPLIANCE REVIEWS based on group

UPM BUSINESS AREAS AND OTHER OPERATIONS

company risk matrix

REGULAR DISCUSSIONS WITH EMPLOYEES , third party due diligence and risk monitoring, reports through UPM Report Misconduct channel, EES and other employee surveys

CASE

COUNTERPARTY SCREENING PROCEDURES

•Business partner screening against public sources •Business integrity (trade sanctions, anti-corruption, anti-money laundering, competition law, fraud)

is to communicate to our employees exam ples of cases of misconduct and how they have been handled within the company. The table below summarises the number of cases recorded in our misconduct case management system in 2022 and provides examples of cases handled. Eight cases led to disciplinary action, including warnings and terminations of employment. Investigations into misconduct include a root cause analysis that aims to identify whether compliance programme improvements are necessary.

Voicing concerns It is an important part of our culture of integ rity that employees feel comfortable voicing any concerns they have and that they can trust UPM to take the appropriate action. If we are worried about anything, we must speak up and act. We do not tolerate retaliation against any person who, in good faith, reports suspected misconduct or participates in an in vestigation to resolve suspected misconduct. In 2022, we published our second inter nal Integrity Report, the purpose of which

GROW YOUR OWN TREE

•Human rights • Environment •Supply chain risk assessments

We update our Code of Conduct every three years to keep it aligned with the fast-changing world. When the Code is renewed, we also provide new mandatory training. The 2022 edition of the e-learning module focused on how we can apply the Code in our everyday work and how our choices impact others, in addition to the main principles of the Code. As with the Code of Conduct document update, one of the key themes in the training was promoting diversity and inclusion. The e-learning training was launched in September with two versions, both in 18 languages, to better target and reflect real life scenarios, one for salaried employees and another for shop floor employees. The idea behind the e-learning training was for partici pants to grow their own tree with their choices. For the second time, we also launched special training materials aimed at UPM man agers. Supervisors received information on what is expected of them as well as support in embedding the culture of integrity in their teams. The manager e-learning, available in six languages, has been completed by 88% of all UPM managers so far. It has been welcomed very positively, as 95% of the respondents feel that the training strengthens their engagement to our culture of integrity.

Low risks

UPM business partner portfolio

Mitigating identified risks

Avoiding high risks

PREVENT •Supplier qualification •Supplier and Third-Party Code •Specific requirements •Enhanced due diligence on selected business partners •Onboarding and contracting process

MONITOR •Supplier audits and corrective action plans •Supplier assessments

REACT •Incident analysis and investigation •Blocking procedure •Contract termination

The reports related to concerns both at UPM and suppliers. They concerned e.g. alleged breach of safety rules, challenges related to leadership and UPM values and discrimination, harassment and inappro priate behaviour.

ALLEGED MISCONDUCT CASES UPM Code of Conduct section Our commitment on integrity Our people and operations Respect people and human rights

2022

2021

5

1

Employee had given gifts to a customer representative in violation of UPM’s poli cies. The employee had also circumvented internal controls at UPM relating to gifts. Written warning.

25

19

Taking care of the environmental impact and product safety

4

2

COMPLIANCE TRAINING FOR SPECIFIC TARGET GROUPS IN 2022

COMPLETION RATES AS OF 31 DECEMBER 2022

SIZE OF TARGET GROUP

Business integrity Zero-tolerance for corruption and bribery

97 99 99 99 99 98

16,000 6,850 6,850 6,850 2,900

Code of Conduct e-learning

2 4 0 8

0 8 5

Personal data protection e-learning

Avoid conflicts of interest

Anti-Corruption e-learning Confidentiality e-learning Competition law e-learning Insider Policy e-learning

Compliance with competition laws Protect assets and information

Employee was supervised by a relative. According to UPM Code of Conduct this kind of direct supervision is not allowed. Written warning.

23

Our stakeholders Know with whom you trade

120 450

6

8

100

Total

54

66

Association participation e-learning

www.upm.com/compliance

76

77

UPM ANNUAL REPORT 2022

UPM ANNUAL REPORT 2022