At Metsä Group, internal control covers financial reporting and other monitoring. Internal control is implemented by the Board of Directors, the Audit Committee and the operative management, as well as the entire personnel. Internal control refers to those management activities that seek to ensure:

• achievement of the goals and objectives set for Metsä Group
• economical, appropriate and efficient use of resources
• management of operational risks
• reliable and correct financial and other management information
• adherence to external regulations and internal policies
• adherence to appropriate procedures related to customer relationships
• sufficient security of operations, information and property
• arrangement of adequate and appropriate manual and IT systems to support operations.

Internal control is divided into: (i) proactive control, such as defining Metsä Group’s values and general operational and business principles,  as well as its goals and strategy; (ii) daily control, such as general control and follow-up with operational systems and work guidelines, related to operational steering; and (iii) subsequent control, such as different management evaluations and inspections, comparisons and verifications, the aim of which is to ensure that the goals are met and that the agreed operational and control principles are followed. Metsä Group’s corporate culture, governance and the approach to control together create the basis for the entire process of internal control.

Internal monitoring of the financial reporting process, credit control and authorisation rights

The financial organisations of the business areas and the Group are responsible for financial reporting. The units and business areas report their financial figures each month. Business area controllers check the monthly performance of units in each business area and report them further to the Group’s financial administration. Business area profitability development and business risks and opportunities are discussed monthly at the Metsä Group Executive Management Team meetings attended by the senior management of Metsä Group and of each business area, and at
financial management team meetings attended by the Group CFO and director of finance and the CFO of each business area, among others. The results are reported to the Board of Directors of Metsäliitto Cooperative each month. The results of the business areas are additionally reported to the Boards of Directors of their parent companies each month. Metsä Group’s Controllers’ Manual describes the reporting and control regulations and the reporting procedure in detail.

Credit control in Metsä Group is carried out by each business area in accordance with the Group credit control policy and the business area-specific credit control policy based on it. Credit control is carried out by the Group’s central credit control organisation in cooperation with the management of the business areas.

Authorisation rights concerning expenses, significant contracts and investments have been specified stepwise for different organisational levels, according to the decision-making order confirmed by the Board and the authority separately granted by the President and CEO and other management personnel.

Investment approval and follow-up is carried out by the business areas and the Group’s financial administration according to the decision-making order and investment policy approved by the Board of Directors. The most significant investments are separately submitted for approval by the Executive Management Team and the Boards of the Group’s parent company, and of the parent company of the business area.

Risk management is an essential part of Metsä Group’s standard business planning and leadership. Risk management is part of daily decision-making, operational follow-up and internal control, and it promotes the objectives set by the company and ensures that they are met.

Linking business management efficiently with risk management is based on the operational principles confirmed by Metsäliitto Cooperative’s Board of Directors; the aim of the principles is to maintain risk management as a process that is well defined, understandable and sufficiently practical. Risks and their development are reported on a regular basis to the Board’s Audit Committee. Centralised risk management also takes care of the coordination and competitive bidding for Metsä Group’s insurance coverage.

The most crucial objective of risk management is to identify and evaluate those risks, threats and opportunities which may have an impact on the implementation of the strategy and on how short-term and long-term objectives are met. A separate risk review is also included in the most significant investment proposals.

The business areas regularly evaluate and monitor the risk environment and related changes as part of their annual and strategic planning. The risks identified and their means of control are reported to the company’s management, Audit Committee and the Board of Directors at least twice a year. Business risks also involve opportunities, and they can be utilized within the boundaries of the agreed risk limits. Conscious risk-taking decisions must always be based on an adequate evaluation of the risk-bearing capacity and the profit/loss potential, among other things.

Risk management responsibilities

Risk management responsibilities in Metsä Group are divided as follows:

• The Board of Directors is responsible for Metsä Group’s risk management and confirms the company’s risk management policy.
• The Audit Committee evaluates the adequacy of Metsä Group’s risk management and the essential risk areas and provides the Board of Directors with related proposals.
• The President and CEO and the members of the Executive Management Team are responsible for the specification and adoption of the risk management principles. They are also responsible for ensuring that the risks are taken into account in the company’s planning processes and that risk reporting is adequate and appropriate.
• The Group’s Risk Management Director is in charge of the development and coordination of the risk management process, the performance of risk assessment and the essential insurance decisions.
• Business areas and services functions identify and evaluate the essential risks related to their own areas of responsibility in their planning processes, prepare for them, take necessary preventive action and report on the risks as agreed.

Risk management process

The essential elements of Metsä Group’s risk management include implementing a comprehensive corporate risk management process that supports the entire business, protecting property and ensuring business continuity, Metsä Group’s security and its continuous development, as well as crisis management and continuity and recovery plans. According to the risk management policy and principles, adequate risk management forms a necessary part of the preliminary review and implementation stages of projects which are financially or otherwise significant.

The tasks of risk management are to

• ensure that all identified risks with an impact on personnel, customers, products, property, information assets, corporate image, corporate responsibility and operational capacity are controlled according to applicable laws and on the basis of best available information and financial aspects;
• ensure that Metsä Group’s objectives are met;
• fulfil the expectations of stakeholders;
• protect property and ensure disruption-free business continuity;
• optimise the profit/loss possibility ratio;
• ensure the management of Metsä Group’s overall risk exposure and minimise the overall risks.

The most significant risks and uncertainties that Metsä Group is aware of are described in the report of the Board of Directors.