Risk Management and Internal Control

The Company's internal controls related to its financial reporting are based on the monitoring of business processes. The information for financial reporting is created as business processes progress, and all process participants are responsible for the correctness of the information.

The purpose of internal control and risk management that are related to the financial reporting process is to achieve sufficient certainty in the following matters:

• operational profitability and efficiency and capital control

• reliability and completeness of financial and operational information

• compliance with laws, regulations and agreements, as well as ethical principles and social responsibility

• securing and responsible management of assets and brands.

In order to ensure the efficiency of internal control associated with the financial reporting process, internal control is performed by the Board of Directors, the Audit Committee, the CEO, the CFO, the Pihlajalinna Group's Management Team and the business controllers. They perform continuous monitoring as part of their daily tasks or on the basis of separate assignments.

Pihlajalinna Group manages the risks related to its financial reporting process in various ways, including:

• the appropriate organization and sufficient resourcing of financial and data administration

• regular review of individual job descriptions in order to eliminate risky work combinations

• the Pihlajalinna Group's centralized reporting system with the appropriate user authorizations

• uniform basic systems in financial and HR administration with the appropriate user authorizations

• guidelines for accounting and reporting and a shared chart of accounts

• continuous staff training

• verification of the report data as part of the reporting process and data administration

The ultimate responsibility for the due arrangement of internal control related to financial reporting lies with the Board of Directors. The Board of Directors reviews and approves the annual financial statements and interim reports. The Audit Committee assists the Board of Directors in monitoring the effectiveness of the principles of internal control and risk management. The Audit Committee monitors the financial statement and financial reporting process in order to ensure the high quality and integrity of the financial statements and related information.

The Company's Board of Directors evaluates the level of internal control at least once a year. If necessary, the Board of Directors can also appoint an external service providers to perform internal control measures.