Lehto Group Oyj

Governance Information • Apr 30, 2024

Corporate Governance Statement 2023

Lehto Group Plc

1. INTRODUCTION 1
2. DESCRIPTIONS CONCERNING CORPORATE GOVERNANCE 1
General Meeting of Shareholders 1
Board of Directors 2
Board committees 5
Shareholders' Nomination Committee 6
Group Management 7
3. MAIN FEATURES OF THE INTERNAL CONTROL AND RISK MANAGEMENT SYSTEMS
RELATED TO THE FINANCIAL REPORTING PROCESS 9
Risk management 9
Internal control 10
Internal controls over financial reporting 10
Risk management and internal control roles and responsibilities 12
4. OTHER INFORMATION TO BE PROVIDED 13
Insider Administration 13
Related party administration 14
Internal auditing 14

1. Introduction

Corporate governance at Lehto Group Plc (hereinafter "Lehto Group" or "Company") is based on the laws in force and the Company's Articles of Association. Lehto Group follows the rules and regulations of Nasdaq Helsinki Ltd (hereinafter "Nasdaq Helsinki" or the "Helsinki Stock Exchange") and the Finnish Corporate Governance Code 2020 (hereinafter "Corporate Governance Code") issued by the Securities Market Association. The Corporate Governance Code is available in its entirety on the website of the Securities Market Association at www.cgfinland.fi.

On 26 March 2024, the Company's Board of Directors approved this Corporate Governance Statement (hereinafter "CG Statement"), which was drawn up separately from the report by the Board of Directors. This CG Statement is published on Lehto Group's website at www.lehto.fi/en/investors/corporate-governance/.

2. Descriptions concerning corporate governance

The responsibility for Lehto Group's corporate governance has been divided in accordance with the Limited Liability Companies Act between its General Meeting of Shareholders, the Board of Directors and the CEO. Shareholders exercise their rights mainly in the General Meeting of Shareholders, which is normally convened by the Company's Board of Directors. Furthermore, a General Meeting of Shareholders must be held if so required in writing by the Company's auditor or shareholders representing at least one tenth of all shares issued by the Company.

General Meeting of Shareholders

The General Meeting of Shareholders is Lehto Group's highest decision-making body. According to the Limited Liability Companies Act, the shareholders exercise their power of decision in matters related to the Company at the General Meeting of Shareholders. The General Meeting of Shareholders decides on matters required by the Limited Liability Companies Act and the Company's Articles of Association. The shareholders participate in the General Meeting of Shareholders either personally or through a representative. Each share entitles its holder to one vote.

The Annual General Meeting is held annually on the date determined by the Board of Directors, within six (6) months from the termination of the financial year. In accordance with the Limited Liability Companies Act and the Articles of Association, the Annual General Meeting decides on matters that fall within its competence, such as adoption of the financial statements, the use of the profit shown on the balance sheet, and the appointment of the members of the Board of Directors and the auditor and their remuneration. The Annual General Meeting also decides on the discharge of the Members of the Board of Directors and the Chief Executive Officer from liability. An Extraordinary General Meeting shall be held if the Board of Directors considers it necessary or if the Company's auditor or shareholders whose shares represent at least one tenth of all shares issued by the Company so demand in writing in order for a given matter to be dealt with.

In accordance with the Company's Articles of Association, a written notice of a General Meeting of Shareholders shall be given to shareholders no earlier than three (3) months and no later than three (3) weeks prior to the shareholders' meeting, however, no later than nine (9) days prior to the record date of the General Meeting of Shareholders. A notice of a General Meeting of Shareholders shall be given by publishing it on the Company's website or in some other verifiable written form.

Board of Directors

The General Meeting of Shareholders elects the members of the Board of Directors. By virtue of the Company's Articles of Association, the Company has a Board of Directors which consists of three to eight (3–8) ordinary members. The Board members' term of office shall expire at the end of the next Annual General Meeting following their election.

Composition and operations of the Board of Directors

The Board of Directors has drawn up a charter of the Board of Directors, which defines the Board's key duties and operating principles.

The Board of Directors shall see to the administration of the Company and the appropriate organisation of its operations and is responsible for the appropriate arrangement of the control of the Company's accounts and finances. The Board of Directors, among its other duties, controls and supervises the Company's operative management, appoints, and discharges the CEO, determines the duties and conditions of employment of the CEO, approves the strategic objectives and the principles of risk management for the Company and its businesses and ensures the proper operation of the management system. Furthermore, the Board of Directors shall prepare together with the Shareholders' Nomination Committee a Remuneration Policy of the Company and presents it to the Annual General Meeting for discussion as well as prepares and presents the Remuneration Report for the Annual General Meeting. The Board of Directors also ensures that the Company has defined the operating principles for internal control and that the Company monitors the functioning of the internal control. The Board of Directors approves the policies and guidelines for internal control, risk management and corporate governance, as well as the Company's information dissemination policy. Based on the Company's strategy, the Board of Directors approves the action plan and budget and supervises their implementation. Furthermore, the Board of Directors annually approves the total amount and priorities of investments in the Company's business operations and decides on major and strategically important investments, acquisitions and divestments. The Board of Directors confirms the Company's ethical values and working methods and monitors their implementation. The Board of Directors also defines the Company's dividend policy on the basis of which it submits a dividend proposal to the Annual General Meeting for consideration. The Board of Directors or a member of the Board of Directors shall not comply with a decision of the General Meeting of Shareholders or the Board of Directors where it is invalid owing to being contrary to the Limited Liability Companies Act or the Company's Articles of Association.

The Company aims to ensure that its Board of Directors has, as a whole, and taking into account its duties, sufficient and versatile expertise and experience. In the preparation of the proposal of the Shareholders' Nomination Committee for the composition of the Board of Directors, particular attention shall be paid to the requirements set by the company's operations and development stage, and furthermore it shall be ensured that the Board of Directors and its members have sufficient expertise, know-how and experience to meet the requirements of the company. A person elected as a Board member must have the competence required by the position and the possibility to devote a sufficient amount of time to attending to the duties. The number of Board members and the composition of the board of directors shall be such that they enable the Board of Directors to see to its duties efficiently. For the evaluation of the diversity and composition of the Board of Directors, individuals who have been proposed as members shall, in confidence and as instructed by the Company, provide the information required to evaluate their competence and the amount of time they can devote to the task to the Shareholders' Nomination Committee.

The Board of Directors shall also evaluate the independence of its members. The majority of the Board members shall be independent of the Company. Furthermore, at least two (2) members who are independent of the Company shall also be independent of the significant shareholders of the Company. Board members' independence shall be evaluated on an annual basis.

In 2023, the following people have been members of the Board of Directors: Eero Sihvonen, Hannu Lehto, Anne Korkiakoski (until July 11, 2023), Helena Säteri (until March 30, 2023) and Jani Nokkanen.

Eero Sihvonen has acted as Chairman of the Board of Directors. During the financial year 2023, the Board of Directors had a total of 30 meetings. The average attendance rate of Board members was 99 per cent.

Basic information on Board members, their independence, remuneration, holdings and attendance in Board meetings is provided in the following tables.

MEMBERS OF THE BOARD OF DIRECTORS 2023
Name	Position	Year of birth	Education	Independence of the Company	Independence of significant shareholders
Eero Sihvonen	Chairman of the Board of Directors	1957	M.Sc. (Econ.)	Yes	Yes
Hannu Lehto	Member of the Board of Directors	1963	Construction engineer	No	No
Jani Nokkanen	Member of the Board of Directors	1977	M.Sc. (Econ.)	Yes	Yes
Until 11 July 2023:
Anne Korkiakoski	Member of the Board of Directors	1964	M.Sc. (Econ.)	Yes	Yes
Until the end of the Annual General Meeting on 30 March 2023:
Helena Säteri	Member of the Board of Directors	1956	M.Sc. (Tech.)	Yes	Yes

BOARD MEMBERS DIRECT AND INDIRECT HOLDINGS OF SHARES 31 DECEMBER 2023
Name	No. of shares held	Shareholding ratio
Eero Sihvonen	144,667	0.17 %
Hannu Lehto	191,745	0.22 %
Lehto Invest Oy, a company controlled by the person	33,914,760	38.92 %
Jani Nokkanen	96,771	0.11 %
Board of Directors in total	34,347,943	39.42 %

REMUNERATION OF THE MEMBERS OF THE BOARD (INCLUDING REMUNERATION OF AUDIT COMMITTEE) AND ATTENDANCE IN MEETINGS 2023

Name	Remuneration, paid as shares, EUR	Remuneration, paid as cash, EUR	Board and Committee meeting remunerations, EUR	Attendance in Board meetings
Eero Sihvonen	27,600	50,600	24,100	30/30
Hannu Lehto	13,800	16,675	12,450	30/30
Jani Nokkanen	13,800	22,425	11,300	29/30
Until 11 July 2023:
Anne Korkiakoski	5,829	12,708	7,950	16/16
Until the end of the Annual General Meeting on 30 March 2023:
Helena Säteri	-	6,900	3,000	7/7
Board of Directors in total	55,200	96,600	50,850	99 %

Presentation of Board members

Eero Sihvonen has served as a Member of the Board since the 2022 Annual General Meeting, and as Chairman of the Board since 5 December 2022. Sihvonen has previously served as the Chief Financial Officer for 16 years and also over 10 years as the Executive Vice President of Citycon Plc. His strengths are especially in real estate and other business strategy, financial and financial matters. Sihvonen has previously been a member of RAKLI Ry's board of directors for several years. Sihvonen holds the degree of M.Sc. (Econ.).

Hannu Lehto has been a member of the Board of Directors since the Annual General Meeting on 2 May 2022 and the Chairman of the Board of Directors since the Annual General Meeting 2022 until 5 December 2022. He has strong experience both from being an entrepreneur in the construction branch and from executive duties in Lehto Group during separate phases. Hannu Lehto is the Company's founding shareholder and has been the Company's CEO from 2008 to 2013 and from 2014 to May 2021. Furthermore, he has previously been a member of the Board of Directors and the Chairman of the Board of Directors. Hannu Lehto has been involved in operation on the Company's and its subsidiaries for over 35 years. Lehto holds the degree of Construction engineer.

Jani Nokkanen has been a member of the Board of Directors since Annual General Meeting 2021. Currently Nokkanen is working as the CIO and Partner and member of the Board of Directors of NREP Oy where he has worked since 2008 in different key roles of development and financing. Before NREP he worked in management consulting and strategy related roles. Nokkanen holds the degree of M.Sc. (Econ.).

The memberships of the Board of Directors that ended

Anne Korkiakoskiwas member of the Board of Directors from 2019 until 11 July 2023.

Helena Säteriwas member of the Board of Directors from 2020 until the end of Annual General Meeting 2023.

Statement on the implementation of the Board Diversity Policy 2023

In 2017, the Board of Directors confirmed that the Company's Board Diversity Policy shall be followed in the selection of the persons proposed as Board members. The implementation of the diversity policy will be monitored on an annual basis in connection with the Corporate Governance Statement.

In order to be able to comprehensively support and develop the Company's business, the composition of the Board of Directors shall be sufficiently diverse. When selecting the persons to be proposed as Board members a balance with regard to the educational background, professional skills, experience, nationality as well age and gender distribution of

its members shall be considered. As a whole, the composition of the Board of Directors shall be such that the directors have sufficiently comprehensive competence, skills and experience. The Shareholders' Nomination Committee shall take into consideration the sufficient diversity of the Board when preparing the suggestion for the composition of the Board.

The defined diversity goal is well implemented in the Board of Directors in terms of conditions other than gender. The Board comprises members that have knowledge in commerce, and technology. The Board is composed of members representing different ages and educational backgrounds who most have strong expertise in the real estate business. The Board members additionally have experience in the megatrends identified by the Company, in international duties, the capacity to develop the Company and assess the views of parties that use the Company's services. According to the self-assessment of the Board of Directors, the members of the Board have been able to devote a sufficient amount of time to Board duties to ensure the Board's operating conditions.

After Korkiakoski's resignation, the composition of Lehto's Board of Directors no longer met the recommendation no. 8 (Composition of the Board) regarding the diversity of the board, because after Korkiakoski's resignation, the Board no longer includes both genders. The reason for the deviation is that due to the challenging financial situation of the company and also the market, choosing a new board member would have been difficult. As a result, the company has temporarily deviated from recommendation 8 of the Corporate Governance Code, but the company's goal is that in the future both genders will be represented in the composition of the Board of Directors.

Board committees

The preparation of matters within the competence of the Board of Directors may be made more efficient by the establishment of Board committees allowing more extensive concentration on matters. The committees have no independent decision-making power, but they prepare issues which will be resolved by the Board. The Board of Directors remains responsible for the duties assigned to the Committee. The Committee shall regularly report on its work to the Board of Directors. The reports shall include at least a summary of the matters addressed and measures proposed by the Committee. The Annual General Meeting decides on the remuneration of the members of the Board committees.

Audit Committee

The Audit Committee is tasked with preparing matters relating to the Company's financial reporting and control. The key duties and operating principles of the Committee are described below.

The main duties of the Audit Committee are:

• to monitor the financial statements reporting process
• to supervise the financial reporting process
• to monitor the efficiency of the company's internal control, internal audit, if applicable, and risk management systems
• to review the description of the main features of the Company's internal control and risk management systems related to the financial reporting process
• to monitor the statutory audit of the financial statements and consolidated financial statements
• to evaluate the independence of the statutory auditor or auditing firm, particularly the provision of related services to the Company
• to prepare a proposal for the election of an auditor.

The Company's Board of Directors shall nominate the Chairman and members of the Audit Committee. The Audit Committee consists of at least three (3) members of the Board of Directors. At least one of them must have special expertise in accounting, bookkeeping or auditing. Board members to be elected as members of the Audit Committee must have extensive knowledge of Company's business operations and business segments and sufficient knowledge of accounting and accounting policies. In its organisational meeting on 30 March 2023, the Board of Directors elected Anne Korkiakoski (Chairman), Eero Sihvonen and Hannu Lehto as members of the Audit Committee. After Korkiakoski's resignation on 11 July 2023, Jani Nokkanen was elected as a member of the Audit Committee and Eero Sihvonen replaced Korkiakoski as Chairman of the Audit Committee. Hannu Lehto continued as members of the Committee. The members of the Committee, except Hannu Lehto, are independent of the Company and its significant shareholders.

The Audit Committee convenes at least twice a year. In addition to the Committee members, the meetings shall be attended by the Company's CEO and Chief Financial Officer and, optionally, the Company's auditors. Furthermore, the Committee members may meet the external auditors without the operative management being present in such meetings. During the financial year 2023, the Audit Committee had four (4) meetings and all members attended all meetings.

Shareholders' Nomination Committee

The Annual General Meeting of Lehto Group Plc decided on 11 April 2017 to establish a Shareholders' Nomination Committee to prepare proposals regarding members of the Board of Directors and their remuneration for the Annual General Meeting. The main responsibility of the Nomination Committee is to ensure that the Board of Directors and its members have sufficient expertise, know-how and experience to meet the requirements of the Company. The Nomination Committee shall adhere to current legislation, other provisions and regulations as well as the rules to which the Company is subject.

The members of the Nomination Committee shall comprise the representatives of the three (3) biggest shareholders who have accepted the responsibility. The biggest shareholders shall be annually named with regard to the situation on the last September date of public trading organised by Nasdaq Helsinki Ltd on the basis of the Company's shareholders' register, held by Euroclear Finland Ltd. Each of the three biggest shareholders shall nominate one (1) representative for the Nomination Committee. Should someone opt out of the nomination right, the right is transferred to the next biggest shareholder in order who otherwise would not have the nomination right. The Chairman of the company's Board of Directors shall act as an expert member of the Nomination Committee without a right to vote.

Should a shareholder who is represented in the Nomination Committee sell over 50% of their shares relative to the situation at the time the shareholder's representative was elected and no longer belongs to the ten biggest shareholders of the Company, said representative must resign from the Nomination Committee. The Nomination Committee must then elect a new member to replace the resigned member.

The new elected member shall be determined by the order of the shareholders such that the shareholder with the greatest number of owned shares without a representative in the Nomination Committee shall have the primary right to name a representative for the Nomination Committee. Should the shareholder opt out of the nomination right, the right is transferred to the next biggest shareholder in order who otherwise would not have the nomination right. The equity holdings shall be evaluated on the basis of the shareholders' register held by Euroclear Finland Ltd according to the time of resignation of the member of the Nomination Committee.

Otherwise, the term of office of the Nomination Committee member shall be valid until the last September date of public trading organised by Nasdaq Helsinki Ltd following the election.

The Nomination Committee shall have quorum when more than half of its members with a right to vote are present. The Nomination Committee cannot make a decision unless all its members have been offered the chance to take part in the discussion regarding the matter as well as the meeting.

The Nomination Committee shall prepare a proposal regarding the composition of the Board of Directors for the Annual General Meeting, which shall decide on the matter. When preparing the proposal, the Nomination Committee shall take into consideration the requirements of the Governance Code and the annual assessment of the Board. If necessary, the Nomination Committee can also listen to outside experts.

In 2023 the Nomination Committee consisted of Hannu Lehto (Lehto Invest Oy), Mikko Kinnunen ja Erkki Veikkolainen (Mevita Invest Oy).

Group Management

CEO

The CEO is in charge of the day-to-day management of the company in accordance with the instructions and orders issued by the Board of Directors. The CEO is responsible for ensuring that the Company's accounting practices are in compliance with the law and that the financial matters are organised in a reliable manner. The CEO has a duty to provide the Board of Directors and its member(s) with any information that the Board of Directors may need in order to see to its duties.

The CEO may undertake measures that are unusual or extensive, considering the scope and nature of the Company's operations, only with the authorisation of the Board of Directors or if it is not possible to wait for a decision of the Board of Directors without causing essential harm to the Company's operations. In the latter case, the Board of Directors shall be notified of the measures as soon as possible.

Juuso Hietanen, born 1977, has been the Company's CEO from May 2021. Hietanen was Bonava Finland's CEO prior to joining the Company. Prior to that, he held management positions in housing production at NCC since 2004 in Finland, Russia, and the Baltic countries. Juuso Hietanen holds the degree of M.Sc. (Eng.).

At the end of the financial period 2023 Juuso Hietanen owns directly or indirectly 230,890 shares of the Company which are 0.26 per cent of the Company's shares.

Group's executive team

The CEO is supported by the Group's executive team which on 31 December 2023 consisted of, in addition to CEO:

• Veli-Pekka Paloranta, CFO, Chief Financial Officer
• Matti Koskela, EVP, Business Premises and Housing
• Matti Kuronen, EVP, Wood construction
• Timo Reiniluoto, EVP, Business Support Services
• Jani Pentti, Vice President, Human Resources

The Group's executive team supports the CEO in duties falling within the CEO's competence, as well as their implementation and monitoring, particularly as regards business development, financing, asset management, internal control and risk management.

Veli-Pekka Paloranta, born 1972, has been the Chief Financial Officer in Lehto since November 2015. In 2000– 2015, he has worked in the JOT Automation and Elektrobit groups. During 2010-2015 he was the CFO of Bittium Plc (former Elektrobit Plc) and since 2020 he has acted as the Member of the Board of Directors and the Member of the Audit Committee in Bittium Plc. Paloranta holds the degree of M. of Sc. (Econ.).

Matti Koskela, born 1966, has acted as EVP, Business Premises since beginning of year 2022 and Housing since autumn 2023. Since 1994, he has worked as a foreman and responsible foreman and as a work manager in construction site production. Since 2001, he has worked in the management positions of residential and office construction and renovation construction as unit manager, business group manager and division manager for a construction company YIT. Koskela holds the degree of Civil engineer. On 27 February 2024 Lehto announced that Matti Koskela will no longer continue to work for Lehto.

Matti Kuronen, born 1980, started in the Group's executive team on 1 November 2023. His area of responsibility in the company is the wood construction business. Matti Kuronen has a long career and experience in construction and management in both the private and public sectors. Along with business, he has successfully led various development projects related to the built environment. Kuronen holds the degree of M. of Sc. (Engineering) and is Doctor of Technology. On 27 February 2024 Lehto announced that Matti Kuronen will no longer continue to work for Lehto.

Timo Reiniluoto, born 1966, served from November 2014 to May 2017 as CEO of Lehto's subsidiary Rakennusliike Lehto Oy. Since March 2017 he has acted as EVP, Business Support Services at Lehto Group. He has 30 years' experience in various tasks in the construction sector, including as EVP and Head of Commercial Construction Southern Finland at Skanska. He also has 10 years work experience in Russia. In addition, Reiniluoto served as Board member of Oy Lautex Ab in 2006–2013. Reiniluoto holds the degrees of M.Sc. (Eng.) and Hanken MBA (Real Estate Finance).

Jani Pentti, born 1974 has served as Vice President, Human resources since summer 2022 and past 3 years as a human resources manager. He has about 15 years of human resource management experience in the construction industry, including the construction company Lemminkäinen and Lehto. Pentti holds the bachelor's degree of Community Educator.

DIRECT AND INDIRECT SHAREHOLDINGS OF GROUP'S EXECUTIVE TEAM 31 DECEMBER 2023
Name	No. of shares held	Shareholding ratio
Veli-Pekka Paloranta	501,653	0.58%
Matti Koskela	-	-
Matti Kuronen	4,000	0.00%
Timo Reiniluoto	35,887	0.04%
Jani Pentti	-	-
Total	541,540	0.62%

The memberships of the Group's Executive Team that ended

Jukka Haapalainen, born 1975, was a member of the Group's Executive Team until June 2023. Haapalainen served as EVP, industrial production.

Tero Karislahti, born 1983, was a member of the Group's Executive Team until autumn 2023. Karislahti served as EVP, Housing.

Business operations management

The Group's operational business was during 2023 divided into two service areas: Business Premises and Housing. Matti Koskela acted as the EVP of Business Premises and from the autumn 2023 he also acted as the EVP of Housing when Tero Karislahti left his position. EVP with the service area executive group, oversee the planning of the service area's products and services, production and sales as well as the general development of the service area. The EVP's report monthly to the CEO of the Group and to the service area steering group. The steering group includes the EVP of the service area, the CEO, CFO and the EVP of Business Support Services as well as other management if necessary.

The actual operative business takes place in the subsidiaries of the Company. Four of the subsidiaries are focused on the functions of the service areas, one is focused on industrial scale production and one in designing and planning. The subsidiary in Sweden no longer has operational activities.

The Group's parent company is not engaged in actual business operations but serves as a hub for a number of shared Group functions which are relevant for the manageability and cost efficiency of the Group's operations. These include human resources management, bookkeeping, coordination of financial affairs, legal, business support services, communications and information management.

3.Main features of the internal control and risk management systems related to the financial reporting process

Risk management

The purpose of risk management is to secure positive development of earnings of the Company and the continuation of the business by implementing risk management cost-effectively and systematically throughout the different businesses. Risk management is part of the Company's strategic and operative planning, daily decision-making process and internal control system. Business objectives, risks and risk management operations are combined through risk management as one chain of events.

The Company adheres to the risk management policy approved by the Board of Directors. Risk management contains all actions, which are connected to setting up targets, identification of risks, measurement, review, handling, reporting, follow-up, monitoring and reacting to risks.

In connection with the strategy process and annual planning, the CEOs of the Company and the EVP's of business areas review business risks which could prevent or endanger the achievement of the Group's strategic or profit targets. The service areas produce risk assessment reports for each business to support the strategy process. Strategic and operative risks are monitored through reporting by the businesses and considered by service area-specific steering groups that convene monthly. The service areas must produce assessments of risks in their own units and provide action plans to manage risks as well as to report on measures taken including the stage and effectiveness of such measures.

The Company's CEO reports the identified risks concerning the Group as well as all planned and effected measures to control such risks to the Board of Directors.

The aim of risk management is to:

• systematically and thoroughly identify and assess all major risks, which threaten the achievement of objectives, including risks related to business operations, property, agreements, competence, currencies, financing and strategy;
• optimise business opportunities and secure continuation of business;
• recognise and identify uncertainties and subsequently develop the prediction of risks and measures needed to manage risks;
• take only calculated and carefully assessed risks with respect to e.g. expanding the business, increasing market share and creating new businesses;
• avoid or minimise liability risks;
• ensure the safety of products, solutions and services;
• establish a safe working environment for the employees;
• minimise possibilities for unhealthy occurrences, crimes or misconduct by operating procedures by various systems, control, and immediate response;
• inform interest groups of risks and risk management; and
• be cost-effective in risk management.

The aim of risk management is not to:

• remove all risks in their entirety;
• adapt unnecessary controlling mechanisms; or
• create unnecessary administrational burden.

Internal control

Internal control is a process performed by the Board of Directors, management and all Group personnel to ensure that there is a reasonable assurance that

• operations are effective, efficient and aligned with strategy;
• financial reporting and management information is reliable, complete and timely made; and
• the Company is in compliance with applicable laws and regulations as well as the Company's internal policies and ethical values.

The first category addresses the basic business objectives, including performance and profitability goals, strategy, implementation of objectives and actions and safeguarding resources.

The second category relates to the preparation of reliable published financial statements, including interim reports and condensed financial statements and selected financial data derived from such statements, such as earnings releases, reported publicly.

The third deals with complying with those laws, regulations, and internal procedures to which the Company is subject to.

Lehto Group's internal control framework consists of:

• the internal control, risk management and corporate governance policies and principles set by the Company's Board of Directors;
• management overseeing the implementation and application of the policies and principles;
• the Finance department monitoring the efficiency and effectiveness of the operations and reliability of the financial and management reporting;
• the Company's risk management process identifying, assessing and mitigating risks threatening the realisation of the Company's objectives;
• compliance procedures making sure that all applicable laws, regulations, internal policies and ethical values are adhered to;
• effective control environment at all organisational levels including control activities tailored for defined processes and creating minimum requirements for the Group's business segments and geographical areas;
• shared ethical values and strong internal control culture among all employees; and
• internal audit assignments reviewing the effectiveness of the internal controls as needed.

Risk management procedures are in place for business processes in the form of defined control points:

• relevant process risks are identified;
• common control points/Group's minimum requirement control points are identified;
• common control points are implemented in business processes;
• additional control points can be determined as needed at business or functional levels.

Control activities are the policies and procedures that help ensure that management directives are carried out. They help ensure that necessary actions are taken to address risks in order to achieve the Company's objectives. Control activities are set throughout the organisation, at all levels and in all functions. They include a wide range of activities, such as approvals, authorisations, verifications, reviews of operating performance, security of assets and segregation of duties.

Internal controls over financial reporting

The purpose of internal controls over financial reporting is to ensure the accuracy, reliability, timeliness and appropriateness of financial information.

Financial reporting organisation and duties

The Group's financial administration is handled centrally by the parent company, whose organisation provides financial administration services to all Group companies. Although the subsidiaries have no actual financial administration

organisation, their personnel produce financial data which is used as part of the Group's financial reporting. The main duties of financial administration include:

• Group accounting
• subsidiaries' accounting
• sales invoicing and accounts receivable management
• accounts payable management
• remittance of payments
• compilation of monthly financial reports supporting the business operations
• cash management and the coordination of financing
• control of the forecast and budgeting process
• taxation and transfer pricing
• company law-related duties.

The financial administration organisation implements operative supervision under the CFO who reports any supervisory findings to the Audit Committee.

The tasks of the financial administration organisation have been divided between individuals and documented in the job descriptions of the teams and employees.

Financial reporting systems

The Group's main financial information system is a modular V10 enterprise resource planning system which has been tailored to the needs of Lehto Group. Since the Group's business operations are mainly project-based, financial and other basic data of the project is entered in the V10 system at the beginning of the project. All income and expenses as well as payments made and received are entered in the system and are further processed for the needs of internal and external accounting.

The general ledger accounting of the Group companies is handled in the V10 system, and Group consolidation is handled in the Cognos Controller system. Payment process is handled through with Nomentia system.

Project and initiative management monitors project progress directly through the Profio (V10) system, but the profit reports of internal accounting are drawn up using Insightsoftware's FPM (Financial Performance Management) system. In the compilation of profit reports, data from Group and subsidiary accounting as well as project data obtained from the Profio system is used.

Supervision of financial reporting

The correctness of financial reporting is ensured through internal instructions, job and process descriptions, authorisation matrices, segregation of obligations and duties related to general ledger accounting, and financial reporting review meetings.

Service area-specific performance data is reviewed in the regular meetings of the service areas' steering groups, where the subsidiaries' management provides background and rationale for the results achieved.

The competences of financial administration personnel are maintained through regular training. Auditors assess the correctness of reporting in connection with, for example, the compilation of interim reports and through their other auditing work performed during the financial year.

Risk management and internal control roles and responsibilities

The key roles and responsibilities regarding the Company's internal control and risk management are defined as follows:

Board of Directors

The Board of Directors is ultimately responsible for the administration of the Company and for the proper organisation of its operations. According to good corporate governance, the Board also ensures that the company has duly endorsed the corporate values applied to its operations. The Board of Directors approves the policies and guidelines concerning internal control, risk management and corporate governance. The Board establishes the risk-taking level and risk bearing capacity of the Company and re-evaluates them on a regular basis as part of the strategy and goal setting of the Company. The Board reports to the shareholders of the Company.

Audit Committee

The Audit Committee of the Board of Directors is responsible for the following internal control related duties:

• monitor the reporting process of financial statements;
• supervise the financial reporting process;
• monitor the efficiency of the Company's internal control, internal audit if applicable, and risk management systems;
• process the descriptions included in the Corporate Governance statement's chapter Main features of the internal control and risk management systems related to the financial reporting process; and
• monitor the statutory audit of the financial statements and consolidated financial statements.

A more detailed description on how the Audit Committee is fulfilling its supervisory role is available in the Committee's annual plan. The Audit Committee reports to the Company's Board of Directors.

CEO

The CEO is in charge of the day-to-day management of the Company in accordance with the instructions and orders issued by the Board of Directors. The CEO sets the ground of the internal control environment by providing leadership and direction to senior managers and reviewing the way they are controlling the business. The CEO is in charge of the Company's risk management process and its continuous development, allocation of resources to the work, review of risk management policies as well as defining the principles of operation and overall process. The CEO reports to the Board on risk management as part of the monthly reporting. The CEO as well as the members of the Group's executive team, who are subordinate to the CEO of the Lehto Group, are in charge of risk management in their own areas of responsibility.

Chief Financial Officer and financial administration

The CFO ensures and controls that the Group's accounting and financial reporting practices comply with the law and that both internal and external financial reporting is reliable.

The financial administration:

• ensures a setup of adequate control activities for service areas in cooperation with their management;
• follows the adequacy and effectiveness of control activities; and
• ensures that external reporting is correct, timely and in compliance with regulations.

HR Director

The HR Director ensures and controls that the Group's payroll administration and the administrative procedures related to employment relationships comply with the law and are duly implemented.

EVP's of service areas

The EVP's of service areas are responsible for the implementation of internal control in their respective services areas. More specific internal control policies and procedures are established within each service area within the principles set by the Group functions. The service area's management is responsible for implementing risk management practices in the planning cycle and daily operations, and ensure the adherence of laws, regulations, internal policies and ethical values in their designated responsibility areas.

Some areas of risk management, in particular the management of financial risks and insurance, have been centralised for the purpose of scale advantage and for securing sufficient Group-level control.

The EVP's of service areas must also ensure that contractual risks related to their business operations have been assessed with sufficient accuracy.

4. Other information to be provided

Insider Administration

The Board of Directors of Lehto Group Plc has ratified on 9 August 2017 the company's Insider Guidelines which include directives and policies concerning insider administration, such as manager's transactions, trading restrictions and insider's register. The Insider Guidelines supplement the provisions of the Market Abuse Regulation (EU No 596/2014, the "MAR") and any rules and regulations based on it, Finnish regulations, such as the Criminal Act (39/1889, as amended) and the Securities Markets Act (746/2012, as amended), as well as Nasdaq Helsinki's Insider Guidelines effective from 3 of July 2016.

Lehto Group's insiders are divided into two groups. Persons obliged to declare insider holdings are members of the Board, CEO and other senior management of the company, who have regular access to inside information and are in the position to make decisions about the company and its future development.

Project-specific insiders are persons who have access to specified inside information. Project-specific insiders may also include persons acting on behalf of the company, such as lawyers and consultants. The company maintains a projectspecific insider's register of any such confidential project that can be described as projects as defined by Nasdaq Helsinki and that can have a material effect on the value of the company's financial instruments.

Lehto Group complies with the EU Regulation on Market Abuse (MAR), which declares that managers under the obligation to report insider holdings may not trade the company's financial instruments during the 30 days prior to the publication of a Lehto Group half year financial report, interim reviews on financial position and development or financial statements release (so called "closed period"). In accordance with the Lehto Group's regulation, the closed period ends the second day from the publication of a Lehto Group half year financial report, interim reviews on financial position and development or financial statements release. In addition Lehto recommends that trading with the company's financial instruments takes place after the end of the closed window, i.e. on the 2nd to 32nd day after the release of financial information. According to Nasdaq Helsinki's insider guidelines the closed window shall be applied to persons that take part in the company's half year financial reports and financial statements and to other persons defined by the company, i.e. extended closed window. The extended closed window implies that trading with the company's financial instruments is prohibited of persons subject to the extended closed window in the 30 days prior to publication of quartal financial information and financial statements including information concerning the financial development of the company. These trading restrictions end on the second day following the publication of financial information. In addition, Lehto recommends for extended closed window that trading with the company's financial instruments takes place after the end of the closed window, i.e. on the 2nd to 32nd day after the release of financial information.

Related party administration

Lehto Group's related parties include Group companies, members of the Board of Directors, the CEO, the Group's top management as well as their families and entities on which related parties or their family members have influence through ownership or management. Related parties also include associated companies and joint ventures.

On 17 June 2020, the Company's Board of Directors approved the guidelines for related party transactions, which determine the principles governing any related party transactions at Lehto Group. In addition to the above-defined related parties, these guidelines are applied more extensively to the Lehto Group's entire personnel. According to the guidelines, all related party transactions shall take place, and prices and other terms shall be set, under market conditions, i.e. under the same principles as with independent parties. The Company maintains a Related Party Log and follows clear reporting and advance approval procedures.

Internal auditing

The Company has no separate internal audit organisation. This is taken into account in the content and scope of the annual audit plan. On the one hand, external auditing focuses on specific areas in turn to be audited, and on the other hand, on separately agreed priority areas.

Auditing

According to Section 6 of the Company's Articles of Association, an audit firm whose chief auditor is a Chartered Accountant shall be elected as the company's auditor. The auditor's term of office shall expire at the end of the next Annual General Meeting following their election. In 2023, KMPG Oy Ab, a firm of authorised public accountants, acted as the Company's auditor, with APA Pekka Alatalo as the principal auditor. The fees for audit services in 2023 totalled approximately EUR 195,000. Furthermore, the Company paid the auditor approximately EUR 22,000 for services not related to auditing.