UPM Annual Report 2024

First page Table of contents Previous page 238-239 Next page Last page

WE ARE UPM

GOVERNANCE

ACCOUNTS AND PERFORMANCE

Report of the Board of Directors

Sustainability Statement

Financial Statements

Auditor's Report

Sustainability Assurance Reports

RESPONSIBLE SOURCING

points. External stakeholders include employees and representatives of UPM's business partners and their suppliers and sub-suppliers, people in the affected local communities, and job applicants. The platform for the UPM Report Misconduct channel SpeakUp® is provided by an external service supplier. It allows anyone to raise concerns confidentially and anonymously if they wish. Reports can be made in more than 40 languages, and concerns can also be raised by telephone. Concerns about unlawful behaviour or behaviour that is in conflict with the UPM Code of Conduct or other Company policies may also be identified based on UPM's compliance monitoring activities (e.g. reviews, audits and counterparty screening procedures). Investigating concerns and incident handling UPM has established procedures to investigate business conduct incidents, including suspected corruption and bribery, in a timely, independent and objective manner. UPM's Senior Vice President of Internal Audit (“SVP of Internal Audit”) and the Chief Compliance Officer ensure that all cases reported through the UPM Report Misconduct channel are properly investigated and documented. The SVP of Internal Audit is responsible for the UPM Report Misconduct channel and its correct operation. Members of the Internal Audit Team and the Compliance Team, including the SVP of Internal Audit and the Chief Compliance Officer, as well as the appointed local person(s), are responsible for handling reports in accordance with the EU directive (EU) 2019/1937 (EU Whistleblowing Directive) as implemented at national level. The responsibility for handling each report is determined on a case-by-case basis by the SVP of Internal Audit and the Chief Compliance Officer. The persons handling the reports receive appropriate training. The person(s) responsible for handling the reports take the necessary actions in response to the report, such as verifying the report’s validity, forwarding the case to a competent authority, conducting or overseeing the investigation, and informing the person who made the report of the action taken. All reports and related information are treated with strict confidentiality. No one will be considered liable for the alleged misconduct before a report has been thoroughly investigated. Protection against retaliation The identity of the person who made the report and any person mentioned in the report is strictly confidential. During the investigation, the investigator(s) must protect the reputation of all parties involved (those reporting and those being reported) by restricting access to information related to the allegations and the investigation to those who have a legitimate need to know. UPM also has a strict policy of non-retaliation. UPM does not tolerate retaliation against anyone who in good faith reports suspected misconduct or participates in an investigation to resolve suspected misconduct. Retaliation or tolerating retaliation is in itself considered misconduct and must be reported promptly. Among other things, UPM's Code of Conduct e-learning course, which is mandatory for all employees, covers how to raise concerns and UPM's non-retaliation policy. In addition, regular communication on the topic is provided to employees.

UPM is subject to legal requirements under national law transposing EU Whistleblowing Directive on the protection of persons who report breaches. Training on business conduct policies Policies and procedures are implemented through training and communication. Available compliance e-learning courses with the target group and completion rates are as follows:

Suppliers also play an important role in UPM's business-specific growth projects. Supplier management, with the required competencies and digitalisation, boosts product development and the commercialisation of new products. UPM's responsible sourcing targets for 2030 Responsible sourcing has been identified as one of UPM's focus areas. The following targets for 2030 have been defined and are followed up regularly. These targets support UPM's policy objective for responsible sourcing practices (UPM Code of Conduct). UPM's sustainability targets are developed by UPM by taking the views, wishes and perspectives of external stakeholders from UPM's constant multi-stakeholder dialogue into account.

G1-2

Suppliers are an essential part of UPM's value chain. UPM buys products, materials and services from around 23,000 B2B suppliers globally. The sourcing network includes suppliers from start-up companies to international corporations. The Company also buys wood from around 14,500 private forest owners. The main sourcing categories are fibre, chemicals, other raw materials, logistics, energy and indirect purchases such as services. When selecting suppliers, UPM's most important priorities include reliable long-term deliveries, cost-competitiveness, product and service quality, suppliers' financial stability, social and environmental responsibility, product safety, and the product's carbon footprint.

COMPLETION RATES AS OF 31 DEC 2024

COMPLIANCE TRAINING FOR SPECIFIC TARGET GROUPS

SIZE OF TARGET GROUP

Code of Conduct e-learning

99% 98% 98% 99% 97% 99% 97% 99%

15,100

Personal data protection e-learning

6,700 6,700 6,700 2,900

Anti-Corruption e-learning Confidentiality e-learning Competition law e-learning Insider Policy e-learning

SUSTAINABILITY FOCUS AREA AND KEY PERFORMANCE INDICATOR

BASE YEAR

BASE YEAR VALUE

2030 TARGET

TARGET FOLLOW-UP 2024 (2023)

160

Responsible sourcing UPM total spend covered by UPM Supplier and Third-Party Code

Association participation e-learning

1,000 6,700

2015

79%

>80% (continuous)

91% (89%)

Cybersecurity e-learning

2025 Value to be defined in 2025

100% New target, see information below the table

Strategic, critical and high sustainability risk supplier spend covered by an EcoVadis assessment indicating low sustainability risk

UPM's e-learning modules are available on a global UPM e-learning platform and are easily accessible to all employees. Completion of mandatory e-learning courses is a prerequisite for short-term incentive payments. The e-learning courses are valid for three years, except for cybersecurity, which is valid for one year. UPM has a Group-level target of 100% participation in training on the UPM Code of Conduct. By the end of 2024, 99% (98%) of active employees completed the training, excluding UPM Raflatac companies acquired in 2024. UPM also offers compliance e-learning courses to employees of business partners working for UPM. This ensures that they are committed to the same standards of integrity. UPM complements the e-learning modules with in-person and virtual compliance training for specific target groups. The target groups are determined based on risk assessments. Compliance training is complemented by regular communication activities to maintain awareness among employees. UPM has identified its salaried employees as the most exposed to corruption and bribery, as they have financial and other decision making power that can make them more susceptible to corruption and bribery compared to shopfloor employees. Anti-corruption training is provided to all salaried employees.

2018

-30%

-22% (-23%)

CO 2 emissions from materials and logistics (Scope 3)

6.08 mt CO 2 eq

Contractual payment terms UPM follows the contractual payment terms as defined by UPM or, in some cases, by the supplier. The due date determines the payment schedule. The invoice processing schedule is defined for invoice verifiers and approvers and is monitored daily. In the event of delays, notifications are sent, and processes can be escalated. There are no special procedures for SMEs.

Following the launch of the Sustainable Supply Chain Programme in 2023 (next page), UPM aligned its Group-level disclosure of sourcing related 2030 targets. The targets on raw material spend covered by the UPM Supplier and Third-Party Code and on continuous supplier auditing were replaced with a new target: by 2030, 100% of UPM's strategic, critical and high sustainability risk supplier spend will be covered by an EcoVadis assessment indicating a low sustainability risk. In 2024, the focus of the new target was on the evaluation of the status for critical and high sustainability risk suppliers which resulted in a percentage of 80% of suppliers with a score indicating a low sustainability risk by spend. UPM has identified approximately 120 Tier 1 suppliers in the high sustainability risk and critical suppliers range, which correlates to an average spend of EUR 1.2 billion. In 2025, the status of strategic suppliers will be evaluated and the common baseline value for the three supplier groups defined. The progress of the other Group-level targets for sourcing is in line with the planned development.

» Refer to E1-4 for details on the CO 2 target for Scope 3. » Refer to G1-2 for details on supplier auditing.