Etteplan Oyj

Governance Information • Feb 8, 2024

CORPORATE Annual Report 2023 GOVERNANCE STATEMENT

2023

Contents

• CORPORATE GOVERNANCE STATEMENT 2023
• General meeting
• Board
• Board committees
• CEO
• Management group
• Internal control, risk management and internal audit
• Insider administration
• Reporting misconduct and violations
• Related party transactions
• Audit
• Communications
• RISKS AND RISK MANAGEMENT IN 2023

Corporate governance statement 2023

This corporate governance statement has been prepared in accordance with the Finnish Corporate Governance Code 2020. The corporate governance statement has been prepared as a part of the annual report and it is also available separately on the Company's website www.etteplan.com. Etteplan Oyj's Board of Directors and its Audit Committee have reviewed this corporate governance statement. Etteplan Oyj's external auditor, KPMG Oy Ab, has checked that this statement has been issued and that the description of the main features of the internal control and risk management systems pertaining to the financial reporting process is consistent with Etteplan Oyj's financial statements.

General governance principles

Etteplan Oyj is a Finnish public limited company that in its decision-making and governance complies with the Finnish Companies Act, the Securities Market Act, other legislation concerning publicly listed companies, and the Articles of Association of Etteplan Oyj.

The Company is a publicly listed company that abides by the regulations of Nasdaq Helsinki Ltd. Etteplan complies with the Finnish Corporate Governance Code 2020 published by the Securities Market Association. Etteplan does not deviate from any single recommendation of the Code. The Finnish Corporate Governance Code is available on the Securities Market Association's website www.cgfinland.fi.

Supervision and management of the Company is divided among the General Meeting of Shareholders, the Board of Directors, and the CEO. The CEO is assisted by the Management Group in the operative management of the Company and in coordinating its operations. The Management Group members are not members of the Board of Directors.

ADMINISTRATIVE BODIES OF ETTEPLAN OYJ

GENERAL MEETING

The shareholders exercise their decision-making power at the General Meeting which is the highest decisionmaking body in the Company. Each Company share entitles the holder to one vote at a General Meeting. The Company must hold one General Meeting for shareholders annually, by the end of June. An Extraordinary General Meeting will be held, if the Board of Directors deems it necessary or if it is requested in writing by a Company auditor or shareholders holding a minimum of 10 percent of the Company's shares, for the purpose of discussing a specific issue. A shareholder may exercise his/her right to speak, ask questions and vote at the General Meeting. The matters to be considered at the Annual General Meeting are specified in section 8 of Etteplan's Articles of Association and in Chapter 5, Section 3 of the Companies Act.

Resolutions made by the General Meeting are published without delay after the meeting by a stock exchange release and on the Company's website www.etteplan.com.

Information on General Meetings to Shareholders

The Board of Directors shall convene the Annual General Meeting or an Extraordinary General Meeting with a notice to be published on the Company's website www.etteplan.com. The notice must list the matters to be considered at the meeting. The Board may also decide to publish the invitation to the General Meeting in one Finnish national newspaper, determined by the Board. The notice to a meeting and the Board of Directors' proposals for the meeting are also published as a stock exchange release.

The notice of the General Meeting includes a proposal for the agenda of the meeting. The notice to the General Meeting, documents to be submitted to the General Meeting and draft resolutions to the General Meeting will be available on the Company's website www.etteplan.com at the earliest two months and at the latest three weeks before the General Meeting.

The Company will disclose on its website the date by which a shareholder shall notify the Board of Directors of the Company of an issue that he/she demands to be included in the agenda of the Annual General Meeting.

The minutes of the General Meeting shall be posted on the Company's website within two weeks of the General Meeting. The documents related to the General Meeting shall be available on the Company's website at least for five years after the General Meeting.

Organization of the General Meeting

According to the Company's Articles of Association the General Meeting shall be held in the Company's domicile or in Vantaa or Helsinki as decided by the Board of Directors of the Company.

To be able to participate in the General Meeting, a shareholder must be registered on the record date in Etteplan Oyj's shareholder register, maintained by Euroclear Finland Ltd. A nominee registered shareholder who intends to take part in the General Meeting is advised to request the necessary instructions regarding entry in the Company's shareholder register and the issuing of proxy documents from their account holder. A notification by a holder of nominee registered shares for temporary inclusion in the Company's shareholders' register is perceived as prior notice of participation in the General Meeting.

Shareholders must register for a General Meeting in advance, within the time period prescribed in the notice. A shareholder may participate in a General Meeting personally or through a duly authorized proxy. The proxy must present a power of attorney form for such authorization. Upon registration for a General Meeting, the shareholder must report to the Company any powers of attorney issued. The shareholder and proxy may have an assistant present at the meeting.

Attendance of the Board of Directors, Managing Director, and Auditor at the General Meeting

The Chairman of the Board of Directors and the members of the Board and its Committees as well as the CEO shall attend the General Meeting. In addition, the Auditor shall be present at the Annual General Meeting.

Attendance of a prospective Director at a General Meeting

A person proposed for the first time as Director shall participate in the General Meeting that decides on his/ her election, unless there are well-founded reasons for absence.

BOARD

The Board of Directors is responsible for the Company's management and for the due organization of the Company's operations in accordance with the relevant legislation and the Company's Articles of Association. The Board of Directors controls and monitors the Company's operational management, appoints and dismisses the CEO, and approves the major decisions affecting the Company's strategy, capital expenditures, organization, remuneration and bonus systems covering the management, and finances. The Board of Directors also approves the principles of risk management and ensures the proper operation of supervision of the management system.

Charter of the Board

As part of the Company's corporate governance, the Board of Directors has approved a written charter to control Board work. The Board's charter complements the stipulations of the Finnish Companies Act and the Articles of Association of the Company. The charter of the Board is presented on the Company's website www.etteplan.com.

Composition of the Board

The Annual General Meeting elects the members of the Board of Directors. The Nomination and Remuneration Committee of the Board of Directors of Etteplan Oyj prepares a list of proposed members of the Board of Directors for consideration of the Annual General Meeting. The Board proposed candidates are reported upon in the notice to the meeting and on the Company's website.

According to the Articles of Association, the Board of Directors shall have a minimum of three and a maximum of seven members. The Annual General Meeting shall elect the Board of Directors for a term of one year at a time.

Etteplan Oyj Board of Directors appointed by the Annual General Meeting held on April 5, 2023 according to the proposal of the Nomination and Remuneration Committee

	Born	Education	Occupation	Member since	Shareholding (31 Dec 2023)
Robert Ingman, chairman	1961	M.Sc. (Eng.), M.Sc. (Economics)	• Managing director, Ingman Group Oy Ab • member of the Nomination ja Remuneration Committee • independent of the company	2009	16,730,000 shares
Matti Huttunen	1967	B. Sc. (Eng.), EMBA studies	• Managing Director, Operations EV Uusikaupunki, Valmet Automotive EV Power Oy • chairman of the Nomination ja Remuneration Committee • independent of the company and of significant shareholders	2015	no ownership
Päivi Lindqvist	1970	M. Sc. (Economics), MBA	• CFO, Glaston Oyj • chairman of the Audit Committee • independent of the company and of significant shareholders	2020	1,000 shares
Tomi Ristimäki	1975	M. Sc. (Technology), Electrical Engineering	• CEO and President, Kempower Oyj • member of the Audit Committee • independent of the company and of significant shareholders	2023	no ownership
Leena Saarinen	1960	M.Sc. (Food Technology)	• Professional board member • member of the Audit Committee • independent of the company and of significant shareholders	2013	1,138 shares
Sonja Sarasvuo	1994	D.Sc. (Economics and Business Administration), marketing	• Post-doctoral researcher, teacher, Hanken School of Economics, Department of Marketing, CERS Centre of Relationship Marketing and Service Management • member of the Audit Committee • independent of the company	2023	no ownership
Mikko Tepponen	1979	M.Sc. (Technology)	• Chief Digital Officer and Chief Operations Officer, FLSmidth A/S • member of the Audit Committee • independent of the company and of significant shareholders	2017	no ownership

The ownerships are listed as per December 31, 2023 and include shares possibly owned by controlled entities.

The Board of Directors of Etteplan Oyj elected on April 5, 2023 in its organization meeting subsequent to the Annual General Meeting Robert Ingman as Chairman of the Board.

Further information on the Board members is available on the Company's website www.etteplan.com.

Meetings of the Board

The Board of Directors meets as often as appropriate fulfilment of its obligations requires. In the financial period 2023, the Board held a total of 13 meetings three of which were e-mail meetings and two Teams meetings. The average attendance rate of Board members was 99 percent. In addition to the members of the Board, the Company's CFO as the Secretary to the Board and the CEO attended Board meetings.

Independence of the Board

The majority of the members of the Board shall be independent of the Company. In addition, at least two of the members of the Board representing this majority shall also be independent of significant shareholders of the Company.

The Board shall evaluate annually the independence of its members and report which of them are independent of the Company and which are independent of significant shareholders.

Robert Ingman, Matti Huttunen, Päivi Lindqvist, Tomi Ristimäki, Leena Saarinen, Sonja Sarasvuo and Mikko Tepponen are independent of the Company.

Matti Huttunen, Päivi Lindqvist, Tomi Ristimäki, Leena Saarinen and Mikko Tepponen are independent of significant shareholders. Robert Ingman and Sonja Sarasvuo are not independent of the Company's significant shareholders due to their holdings in related parties.

Diversity of the Board

The Board of Directors of Etteplan has defined the principles on the diversity of the Board in compliance with the Corporate Governance Code 2020. Accordingly, the requirements on the size, market position, and business industry of the Company should be duly reflected when composing the Board of Directors.

When composing the Board of Directors the objective is that the members have versatile and different knowhow on various industries so that the professional profiles of the members complete each other. A member of the Board must possess the competence and the educational background required by the task and the possibility to allocate sufficient time for the task. The composition of the Board aims to ensure that it has extensive know-how on the essential strategic focus areas of the Company. In addition, the aim is to ensure that the Board will consist of both genders.

The diversity principles defined by the Board of Directors were well fulfilled in the financial period 2023. The Company will continue to execute the principles in the financial period 2024.

Performance evaluation of the Board

On an annual basis, the Board of Directors assesses its own activities and work practices. The Board specifies the criteria to be used in the assessment, which is carried out as internal self-evaluation. The results of these activities are handled by the Board.

Remuneration of the Board

Further information on the remuneration of the Board of Directors in the financial period 2023 is available in the separate Remuneration Report for Governing Bodies 2023 published by the Company and on the Company's website www.etteplan.com. The Remuneration Report of Governing Bodies will be presented annually to the Annual General Meeting.

Board of Directors

From the top left: Robert Ingman, Matti Huttunen, Päivi Lindqvist, Tomi Ristimäki, Leena Saarinen, Sonja Sarasvuo, Mikko Tepponen

BOARD COMMITTEES

The Board of Directors will decide, when needed, on the establishment of committees to assist the Board in preparing and handling matters falling within its competence. The committees are not decision-making or executive bodies, but assist the Board in the decision-making falling under the scope of each committee.

The Board of Directors of Etteplan Oyj has an Audit Committee and a Nomination and Remuneration Committee.

Audit Committee

The Board of Directors of Etteplan Oyj has appointed an Audit Committee among the Directors. The Board has confirmed the central duties and operating principles of the Committee in a written charter. The charter of the Committee is presented on the Company's website www.etteplan.com. The Chairman of the Audit Committee reports on each Committee meeting to the Board of Directors.

The task of the Audit Committee is to assist the Board of Directors in ensuring that the Company's financial reporting and accounting principles as well as the financial statements and other financial information given by the Company comply with laws and regulations and are transparent, explicit and clear. The duties of the Audit Committee are, inter alia, monitoring the Group's financial and financing situation, the Group companies' financial statements and consolidated financial statements reporting process, the efficiency of the Company's internal control, internal audit and risk management systems as well as the statutory audit of the Company's financial statements and consolidated financial statements. The Committee further supervises the Company's financial reporting process and assesses the independence of the auditor and the non-audit services provided by the auditor and that the Company complies with laws and regulations. The Audit Committee reviews the description of the main features of the internal control and risk management systems pertaining to the financial reporting process included in the Corporate Governance Statement of the Company and prepares the resolution proposal relating to the election of the auditor. In addition, the Audit Committee monitors the non-financial/CSRD reporting process and reviews the statement of non-financial information annually. The Board of Directors may also allocate other duties to the Committee.

The Committee consists of three to four members of the Board of Directors. It convenes on a regular basis at least four times a year before the Company's interim or half year financial reports and financial statements are published. The Committee Chairman provides the Board with the proposals made by the Committee. The Company auditor attends the Audit Committee meetings and the Company CFO acts as the Secretary to the Committee. In addition, the Company CEO attends the committee meetings.

Since the Annual General Meeting of 2023, Päivi Lindqvist has acted as the Chairman of the Audit Committee and Tomi Ristimäki, Leena Saarinen and Sonja Sarasvuo as members of the Committee. All members of the Committee are independent of the Company. Mikko Tepponen acted as a member of the Audit Committee until the Annual General Meeting of 2023.

In the financial period 2023, the Audit Committee held a total of five meetings, all meetings were Teams meetings. The average attendance rate of Committee members was 100 percent.

Nomination and Remuneration Committee

The Board of Directors of Etteplan Oyj has appointed a Nomination and Remuneration Committee among the Directors. The Board has confirmed the central duties and operating principles of the Committee in a written charter. The charter of the Committee is presented on the Company's website www.etteplan.com. The Chairman of the Nomination and Remuneration Committee reports regularly on its work to the Board of Directors.

The task of the Nomination and Remuneration Committee is to assist the Board of Directors in matters related to the appointment and compensation of the Company's CEO and Management Group. In addition, the Committee prepares for the Annual General Meeting a proposal on the number of Board members, Board composition and Board member compensation. The Committee also recommends, prepares and proposes to the Board the CEO's and the deputy CEO's nomination, salary and compensation, and further evaluates and provides the Board and the CEO with recommendations concerning management and employees rewards and compensation systems. In addition, the Nomination and Remuneration Committee prepares the remuneration policy and remuneration report for the Company's governing bodies.

The Committee consists of three members of the Board of Directors. It convenes on a regular basis at least once a year. The Committee Chairman provides the Board with the proposals made by the Committee.

Since the Annual General Meeting of 2023, Matti Huttunen has acted as the Chairman of the Nomination and Remuneration Committee and Robert Ingman and Mikko Tepponen as members of the Committee. All

members of the Committee are independent of the Company. Leena Saarinen acted as a member of the Nomination and Remuneration Committee until the Annual General Meeting of 2023.

In the financial period 2023, the Nomination and Remuneration Committee held a total of five meetings, three of which were Teams meetings. The average attendance rate of Committee members was 100 percent.

The attendance of Board and Committee members at meetings in 2023

	Board of Directors	Audit Committee	Nomination and Remuneration Committee
Robert Ingman	13/13		5/5
Matti Huttunen	13/13		5/5
Päivi Lindqvist	13/13	5/5
Tomi Ristimäki	9/10	4/5
Leena Saarinen	13/13	5/5	2/2
Sonja Sarasvuo	10/10	4/5
Mikko Tepponen	13/13	1/1	3/3

CEO

M. Sc. (Eng) Juha Näkki has been the Company's President and CEO from the beginning of 2012. The CEO is responsible for managing the Group's day-to-day operations in accordance with the rules and instructions issued by the Board of Directors. The CEO may take measures that are unusual and far-reaching with regard to the scope and nature of the Company's operations, but only with authorization from the Board of Directors. The CEO is responsible for ensuring that the Company's accounting complies with the applicable legislation and that its asset management is arranged in a reliable manner. The CEO attends the Board meetings, but he is not a member of the Board of Directors. The CEO also participates in the work of Board Committees. The parent Company's CEO, furthermore, acts as the Group's Chief Executive Officer.

A written CEO agreement, approved by the Board, has been drawn up for the CEO. The Board of Directors appoints the CEO and terminates this employment as well as monitors the CEO's activities.

Further information on CEO Juha Näkki is available on the Company's website www.etteplan.com.

Further information on the remuneration of the CEO in the financial period 2023 is available in the separate Remuneration Report for Governing Bodies 2023 published by the Company on the Company's website www.etteplan.com. The Remuneration Report for Governing Bodies will be presented annually to the Annual General Meeting.

MANAGEMENT GROUP

The CEO appoints members to the Management Group who are appropriate from the standpoint of line operations. The Management Group assists the CEO and also develops and monitors all matters entrusted to the Company's management, including those connected with the Group and business unit strategies, acquisitions, and major capital expenditures, divestments, the Company's image, monthly reporting, interim and half year financial reports and financial statements, corporate responsibility, investor relations, and the main principles of the human resource policy. The Board of Directors approves the appointment of the Management Group members. The members of the Management Group report to the President and CEO.

Etteplan Oyj's Management Group in the financial year 2023

	Occupation	Born	Education	Member since	Shareholding (31 Dec 2023)
Juha Näkki	President and CEO, Chairman of the Management Group	1973	M.Sc. (Eng.)	2008	107,739 shares
Per-Anders Gådin	Senior Vice President, M&A and Business Development	1965	M.Sc. (EP), BBA	2009	13,182 shares
Petri Ikonen	Senior Vice President, Solutions & Technologies	1964	B.Sc. (Eng.)	2015	7,297 shares
Helena Kukkonen	CFO	1972	M.Sc. (Econ And Bus Admin)	2021	2,956 shares
Jukka Lahtinen	Senior Vice President, Global Sales	1963	B.Sc. (Eng.)	2019	7,689 shares
Veikko Lamminen	Senior Vice President, Operational Excellence	1960	B.Sc. ( Eng.)	2012	13,524 shares
Tero Leppänen	Senior Vice President, Software and Embedded Solutions 1974		M.Sc. (Computer Science), B.Sc. (Electronics and Information Technology)	2022	2,446 shares
Riku Riikonen	Senior Vice President, Engineering Solutions	1977	M.Sc. (Eng.)	2015	2,353 shares
Outi Torniainen	Senior Vice President, Marketing and Communications	1965	B.Sc. (Communications)	2016	8,563 shares
Minna Tornikoski	Senior Vice President, HR	1970	M.Sc. (Industrial Engineering & Management)	2019	4,549 shares
Mikael Vatn	Senior Vice President, Technical Communication Solutions	1967	B.Sc. (Eng.), MBA	2012	12,856 shares

The ownerships are listed as per December 31, 2023 and include shares possibly owned by controlled entities.

Further information on the Management Group members is available on the Company's website www.etteplan.com.

Further information on the remuneration of the Management Group in the financial period 2023 is available on the Company's website www.etteplan.com.

Management group

From the top left: Juha Näkki, Per-Anders Gådin, Petri Ikonen, Helena Kukkonen, Jukka Lahtinen, Veikko Lamminen, Tero Leppänen, Riku Riikonen, Outi Torniainen, Minna Tornikoski, Mikael Vatn

INTERNAL CONTROL, RISK MANAGEMENT AND INTERNAL AUDIT

The objective of Etteplan Oyj's internal control and risk management is to ensure that the Company's operations are efficient and profitable, its information is reliable, and it complies with appropriate regulations and operating principles. The objectives also include identification, assessment, and monitoring of risks related to business operations.

Operating principles of internal control

Etteplan's internal control process in controlled by the Finnish Companies Act, the Securities Markets Act, and other laws and regulations applicable to the operations of the Company, the rules and recommendations of Nasdaq Helsinki Ltd. as well as the Corporate Governance Code for Finnish listed companies. External control is implemented by the Company's auditors and the authorities.

Internal control in Etteplan covers financial reporting and other monitoring. The function of internal control is to ensure that the Company achieves the goals and objectives set for it as well as uses its resources economically and appropriately. Internal control also aims to ensure, among other things, correct and reliable financial and other information, compliance with external regulations and internal guidelines and policies as well as sufficient security of operations and information. Furthermore, internal control aims to ensure the organization of adequate and appropriate IT and manual systems to support the operations of the Company.

In Etteplan, internal control is executed by the Board of Directors, management, and the Company's entire personnel. Internal control is divided into 1) proactive control, 2) day-to-day control, and 3) subsequent control. Proactive control consists of specification of corporate values and general operational principles. Day-to-day control includes operational steering and monitoring and thereto related operational systems and work instructions. Subsequent control comprises management evaluations and inspections, comparisons, and verifications with the aim of ensuring that the goals are met and the agreed operational principles are followed.

Organization of risk management

Risk management is an integral part of Etteplan's business management and internal control framework. The function of risk management is to anticipate future risks, to ensure that targets are reached and to secure operations in changing conditions. The objective is to ensure that the Company's operations are efficient and profitable, that the information produced is reliable, and that the Company complies with the appropriate regulations and operating principles.

The key measures of Etteplan's risk management are comprehensive risk identification, focusing on the biggest risks and ways to manage them, securing the continuity of business operations, limiting adverse business impacts, and utilizing opportunities. Etteplan's risk management consists of coordinated measures aiming to identify, evaluate, manage and control all major risk areas of the Group in a systematic and proactive manner.

Etteplan's risk management process is led by the Group President and CEO together with the Management Group member responsible for risk management. The Management Group monitors the significant risks of the business units and supervises the development of the Group's risk management system and practices.

The business managers have the primary responsibility for risk management. Managers are responsible for risk management in their business areas in compliance with the Group's risk management guidelines.

Managers report on the major risks of their business area to the Management Group as part of the monthly business reporting. The Group's financial administration monitors and assesses operational and financial risks and takes measures to hedge against them in cooperation with the Board of Directors, the Management Group, and operative management.

The Board of Directors supervises risk management and approves the risk management guidelines of the Group. Risk management actions and the most relevant Group level risks are reported to the Board of Directors and its Audit Committee.

Risks and risk management are presented on the Company's website www.etteplan.com and as part of this report. Reviews concerning financing risks are presented in the notes to the consolidated financial statements as a part of the Financial Report 2023.

Internal audit

Etteplan Group does not have separate internal audit function. The Board can engage external advisors to perform evaluations relating to control environment or other activities.

Description of the main features of the internal control and risk management systems pertaining to the financial reporting process

Etteplan prepares consolidated financial statements and interim and half year financial reports in accordance with the International Financial Reporting Standards, as adopted by EU, the Securities Markets Acts as well as the appropriate Financial Supervision Authority Standards and Nasdaq Helsinki Ltd's rules. The Report of the Board of Directors of Etteplan and parent company financial statements are prepared in accordance with Finnish Accounting Act and the opinions and guidelines of the Finnish Accounting Board.

Etteplan Group observes Group level accounting principles and instructions, which are applied in all Group companies and according to which the Group's financial reporting is prepared. Together with reporting calendar and schedules, accounting principles and instructions form the framework for timely and correct Group reporting. Etteplan's business operations are in all material respects located in Finland, Sweden, China, the Netherlands, Poland, Germany, Denmark and the USA. All countries have local accounting and financial reporting organizations reporting to the Group using centralized ERP. Internal control and risk

management systems and practices as described in the following section are designed to ensure that the financial reports as disclosed by the Company give essentially correct information about the Company finances.

Etteplan has a common Group consolidation system to which subsidiaries report their accounting data from centralized ERP. The correctness of the data is controlled by the Group's financial administration as well as the financial organizations in the operating countries and service areas. The Group's centralized financial administration prepares consolidated and published financial reports.

Internal control over financial reporting

Proper arrangement and monitoring of internal control is the responsibility of the local management in accordance with the Group framework. Etteplan Board of Directors has approved operating principles of internal control, which have been prepared in accordance with recommendation 24 of the Finnish Corporate Governance Code. Operating principles include the main features of risk management process, summary of risks, control objectives and common control points for financial reporting as well as roles and responsibilities in executing and monitoring internal control in Etteplan.

Internal controls over financial reporting process at the country and Group level are reviewed and updated annually. Etteplan's finance organization has analysed process risks and defined control objectives for external financial reporting process. Existing control points in the process have been documented. These control points include for example reconciliations, authorizations, analysis, and segregation of key accounting duties. The work has been led by the Group CFO.

According to its annual clock, the Management Group has monthly meetings where also financial performance and financial reporting are analyzed. Prior to these meetings, financial reports have been analyzed on business group level to detect any irregularities or errors. Group level financial reports are prepared for Etteplan Audit Committee and the Board of Directors on a monthly basis. The Audit Committee reviews and the Board of Directors reviews and approves interim and half year financial reports, annual results report, and financial statements.

Etteplan does not have separate internal audit function. The Audit Committee and/or the Board of Directors can engage external advisors to perform evaluations relating to control environment or other activities.

INSIDER ADMINISTRATION

The Etteplan Oyj Board of Directors has approved insider regulations for the Company. The regulations are based on the Finnish Securities Markets Act as well as from the beginning of July 2016 the Market Abuse Regulation (EU N:o 596/2104, MAR), and they comply with the standards of Financial Supervision and the Guidelines issued by the Nasdaq Helsinki Ltd.

In accordance with the Market Abuse regulation, Etteplan is no longer under the obligation to maintain a public insider list. However, Etteplan maintains a list of its managers and publishes stock exchange releases on the transactions the managers report to the stock exchange and the Company in compliance with the time limits and obligations defined by MAR. Due to the nature of their position, the members of the Board of Directors, the CEO, and the members of the Management Group are entered into said list of managers.

In addition, the Company maintains a permanent company specific insider list in accordance with the decision of the Board of Directors. The company specific insider list includes front-line managers for business operations, financial administration personnel, and those working for the Company on the basis of an employment or other contract who receive insider information.

A project-specific insider list is created by the decision of the Board of Directors, the CEO, or the Management Group.

The Company's insider guidelines direct insiders to restrict their trading in the Company's shares to times when the markets have as precise information as possible on the factors influencing the value of shares in the Company. Consequently, persons included in Etteplan Oyj's insider lists are always prohibited from trading with Company securities during 30 days before the publication of interim and half year financial reports and financial statement release, including the day of publication (the closed window). During other times, i.e. as of the day following the publication of interim and half year financial reports and financial statement release, there is an open window during which insiders are allowed to trade. Even then it is provided that they do not possess insider information.

The Chief Financial Officer is responsible for the maintenance of the aforementioned lists of Etteplan Oyj. The CFO is also responsible for compliance with insider regulations and fulfilment of duties to report. The aforementioned lists are maintained by the Company's Espoo office, which updates the information that, as required by law, is entered in the lists for Euroclear Finland Ltd pertaining to insiders with the duty to declare.

REPORTING MISCONDUCT AND VIOLATIONS

Etteplan Oyj has an anonymous whistleblowing channel through which both Etteplan employees and external stakeholders can report, for example, potential ethical violations, violations against the Company's insider policy, or suspected infringements of financial markets regulations, such as MAR and the Securities Markets Act. The aim of the whistleblowing channel is to promote compliance with good governance in the Company's daily activities and prevent misconduct and violations.

The whistleblowing channel can be accessed either through the Company's public website or intranet. Reports can be made anonymously. All reports will be directed to the Company's HR Director and CFO, and, when needed, corrective measures will be taken without delay. All reports will be processed confidentially in accordance with the Personal Data Act with regard to both the informant and the person under suspicion.

RELATED PARTY TRANSACTIONS

The Company and its Board of Directors monitor and evaluate transactions between the Company and its related parties. The Company has defined principles and processes for identifying the Company's related parties and the transactions to be carried out with them as well as for evaluating and reporting the nature and terms of such transactions.

In order to identify its related party transactions, the Company keeps record of the persons that are its related parties. The record includes such persons that have control, joint control or significant influence over the Group. Also, the Group's key management personnel is included in the related party. Key management personnel refers to persons having authority and responsibility for planning, directing and controlling the activities of the Group, directly or indirectly, including any director (whether executive or otherwise) of the Group. Spouses, wards and companies in control or joint control of the before mentioned persons are considered as other related parties. The ultimate controlling party, Ingman Group Oy Ab, and its group companies are also included in related parties.

The Audit Committee of the Board monitors the Company's related party transactions in accordance with the Company's reporting practices. Transactions between the Company and its related parties are typically part of the ordinary course of business of the Company and are priced according to Group's normal pricing basis and sales conditions, which are equivalent to those that prevail in arm's length transactions. Related party transactions that are not part of the ordinary course of business of the Company or are not priced according to Group's normal pricing basis and sales conditions and are not implemented under arms-length terms require a decision by the Board of Directors. Board members cannot participate in deciding a related party transaction concerning themselves or their related parties in accordance with applicable laws and regulations.

In 2023, Etteplan's service purchases and sales from and to other related party companies were related to administrative cooperation between the companies.

AUDIT

The primary duty of statutory auditing is to verify that the financial statements give correct and sufficient information about the Group's profit and financial situation for the financial year. Etteplan Oyj's financial year is the calendar year. The auditor is responsible for auditing the Company's accounts and the correctness of its financial statements during the financial year, and for issuing an auditor's report to the Annual General Meeting.

A summary of the Group's audit report is compiled for the Board of Directors. Also, the auditors of all Group companies report separately to the management of each company within the Group. The auditor attends at least one meeting of the Board of Directors in the relevant financial year.

The Annual General Meeting elects one or two auditors to audit corporate governance and accounts. At least one of the auditors must be a firm of independent public accountants so authorized by the Central Chamber of Commerce. The Annual General Meeting held on April 5, 2023 elected KPMG Oy Ab, a firm of authorized public accountants, with Kim Järvi acting as Chief Auditor. The auditor's term ends at the conclusion of the first Annual General Meeting after the election.

Audit fees and services not related to auditing

According to the resolution made by the Annual General Meeting 2023 the fees for the auditor are paid according to invoice approved by the Company.

The audit fees paid to KPMG companies in 2023 totalled EUR 147,955 (in 2022: EUR 123,865). In addition, EUR 51,717 was paid to the firm for services not related to auditing (in 2022: EUR 67,728). EUR 51,717 was paid to KPMG Oy Ab for non-audit services which does not exceed the 70 percent cost limit set for non-audit services.

COMMUNICATIONS

It is Etteplan Oyj's principle to be open, truthful and quick in all communications. The primary objective of the Company's investor information is to provide truthful, sufficient, and current information on the Company's strategy, operations, markets, and financial situation in order for the capital market to have essential information on Etteplan as an investment. The goal is to give all stakeholder groups correct and uniform information in a regular and balanced manner.

Silent period

Etteplan Oyj follows a so-called silent period before publication of interim and half year financial reports and financial statement releases. The duration of the silent period is 30 days before the day of publication.

Distribution of investor information

Etteplan publishes all of its investor information on the Company's website www.etteplan.com. Financial releases will be made available immediately after publication. They will be published in Finnish and English.

Risks and risk management in 2023

A uniform group-wide risk management assessment that covers all risk categories has been conducted annually in connection with the strategy process since 2011. The focus of the assessment is particularly on monitoring changes in already identified risks, identifying new business risks, and developing proactive risk management. Etteplan complies with international risk management criteria (CAS, Casualty Actuarial Society and COSO, Committee of Sponsoring Organizations of the Treadway Commission).

The key aspects of the risk assessment include:

• comprehensive risk identification
• focusing on the biggest risks and ways to manage them
• securing the continuity of business operations
• limiting adverse business impacts
• utilizing opportunities

The most significant risks in 2023

Etteplan's most significant risks in 2023 were related to operational and strategic risks. These risks included the changing business environment and the ability to adopt new technologies, global market uncertainty, growing geopolitical tensions and country-specific political risks. The realization of these risks is mitigated by deepening customer relationships and responding quickly to changing business environment and customer needs.

As in previous years, risks related to personnel remained significant, as the Company's business operations and future growth are based on highly competent personnel. The realization of these risks is mitigated by effective human resources management and by ensuring that Etteplan is perceived as an attractive employer among industry professionals.

Six risk categories

Risks related to Etteplan Group's business activities are classified into six categories, and risks are monitored according to this classification. Etteplan's business risks include both internal and external risks.

• Risk classification: 1. Strategic risks
• 1. Operational risks
• 1. Personnel risks
• 1. IT security risks
• 1. Financial risks
• 1. Regulatory and legal risks

The typical risks of Etteplan's business activities on a general level are described in the following section. However, the Company's operations may also be subject to other risks. The most significant risks and uncertainties identified during the financial year are described in the Financial Statements Release, which is available online at www.etteplan.com.

Strategic risks

In the 2023 assessment, Etteplan's most significant strategic risks were related to the Company's position in the market, the competitive situation, and the utilization of new technologies.

The overall level of strategic risks was significantly higher than in 2022. An economic downturn may have a negative impact on Etteplan's investments and consequently on its business and profitability. The Group seeks to reduce its vulnerability to economic cycles by maintaining a balanced customer base consisting of customers operating in different industries, markets, and geographical areas. The engineering business is characterized by intense global competition.

Operational risks

The level of Etteplan's operational risks decreased significantly compared to the previous year, partly due to changes within risk categories. The main operational risks identified in the assessment were related to the increased global market uncertainty, country-specific political risks, and potential changes in customers' operations. Acquisitions and thereto related integration processes also constitute an operational risk to Etteplan. Etteplan has carefully prepared procedures for acquisitions and integration, which reduces the risk. Project deliveries may also involve significant risks. These risks are mitigated by training, operating in accordance with policies and guidelines, and limiting contractual liability starting from the early stages of the delivery process. Efforts are also made to limit the typical liability risks through standardized contract terms and insurance policies. Insurance does not, however, cover all liability risks.

Personnel risks

Personnel risks can slow down the Company's growth, if they materialize. The availability of competent professionals helps ensure the Company's business development, growth, and profitability. Etteplan's personnel risks were again assessed to be at a high level in 2023. According to the assessment, the most significant personnel risks continue to lie in the global competition for leading experts in the field of technology – i.e. the ability to attract the right competencies and promote employee engagement. Etteplan prevents these risks from materializing through effective human resources management, including regular performance and development discussions, systematic monitoring of occupational health and well-being, and internal procedures and guidelines. The Group promotes the job satisfaction and well-being of its employees by improving Group-wide HR processes and investing in the development of its employees' competence and in the quality of management and leadership. Human resources management and the focus areas in 2023 are described in more detail in the Annual Review.

Financial risks

Etteplan's level of financial risks decreased slightly in 2023 due to the halt in the rise in interest rates. The realization of financial risks is prevented by internal procedures and guidelines as well as internal control. Financial risks are managed in accordance with the treasury policy approved by Etteplan's Board of Directors. The aim is to hedge against significant financial risks, balance cash flow and give the business time to adapt its operations to changing conditions. Reviews of financing risks are presented in more detail in the notes to the consolidated financial statements published as part of the Financial Review 2023 at www.etteplan.com.

IT security risks

The major IT security risks were related to external interference with IT systems. These risks are closely monitored, as Etteplan's business depends on the undisrupted functioning of its information and communication systems. The level of risks remained unchanged at a moderate level in 2023. Etteplan prevents the realization of risks related to information security through internal procedures and guidelines, as well as internal control. Measures that limit the effects of external influences on systems include firewalls, system monitoring, virus scanners, access rights management, and backups.

Regulatory and legal risks

The major risks are related to the EU General Data Protection Regulation and the processing of personal data, but these risks remained at a low level in 2023. These risks are managed by, for example, maintaining a high level of data protection through new training, and by continuously developing data protection systems that are integrated into the Company's processes. Developments in legislation are monitored in all areas of the Company, and operations are updated as necessary.

Risk category	Examples of risks	Examples of risk mitigation actions	Responsibility
Strategic risks	Risks related to business development, strategy implementation, the lack of highly competent professionals, business environment, markets, globalization as well as mergers and acquisitions	Strategy and business plans, diversified customer base, balanced personnel structure, compliance with M&A procedures, corporate governance, Code of Conduct and risk management policy	President and CEO, business management, finance, human resources and communications functions
Operational risks	Risks related to organization and management, sales, projects, assignments, customer relationship and financing	Deepening customer relations, compliance with management systems, core business processes and related policies and guidelines, the Group's insurance	Business management, the development organization, human resources and finance functions
Personnel risks	Risks related to competence management, management and organization, staff turnover, recruitment, assignments, occupational health and well-being related risks	Use of competence management system, employee surveys, internal training, HR management, induction process, compliance with Code of Conduct	Human resources function, business management, all personnel
IT security risks	Information security, network and system downtime, computer viruses and customer IT connections-related risks	Taking information security into account and compliance with guidelines in IT policy and supplier agreements	IT organization, business management, all personnel
Financial risks	Currency, interest, financing and liquidity, counterparty and credit risks related to the financing of business operations	Compliance with payment and credit policies and Group treasury policy, internal controls	CFO, finance function, business management
Regulatory and legal risks	Risks related to the EU General Data Protection Regulation (GDPR)	Training related to data protection, incorporating data protection into the Company's processes and IT policy	President and CEO, IT Director, HR Director, Data Protection Office

Etteplan Oyj Tekniikantie 4 D 02150 Espoo, Finland Tel. +358 10 3070 www.etteplan.com