Internal control is embedded in UPM's management system and it supports systematic execution of the group strategy. Internal control is aimed at ensuring that the company’s operations are efficient and reliable, and in compliance with statutory requirements, and that the company's financial reporting is accurate and reliable, and reflects operational results. The Board of Directors is responsible for ensuring that the company has defined the operating principles of internal control and for monitoring and assessing the effectiveness of such control. The Audit Committee assists the Board in monitoring internal control systems’ effectiveness.
The company’s values and UPM Code of Conduct as well as the group policies and guidelines form the basis and set the tone for internal control at UPM. Internal control is part of the corporate culture, covering all levels and processes of the group. The company’s management system enables effective monitoring in different parts of the group. Internal control in its primary and most extensive form takes place at the operational level, where internal control is continuous and part of daily routines.
An essential part of the internal control environment is the control over UPM’s IT applications and IT infrastructure. A special set of internal controls aims to ensure the reliability of UPM’s IT systems and the segregation of duties in the IT environment.