Kesko Oyj — Governance Information 2013

Mar 6, 2013

KESKO CORPORATION'S CORPORATE GOVERNANCE STATEMENT

2012

This Corporate Governance Statement has been discussed at the meeting of the Audit Committee of Kesko Corporation's Board of Directors on 4 February 2013.

Helsinki www.kesko.fi 00016 KESKO

Kesko Oyj Y-tunnus 0109862-8 Satamakatu 3 Kotipaikka Helsinki

1	RULES AND CORPORATE GOVERNANCE OBSERVED BY KESKO 3
2	DEPARTURE FROM RECOMMENDATION 10 OF THE CORPORATE GOVERNANCE CODE (BOARD MEMBERS' TERM) AND EXPLANATION FOR THE DEPARTURE 3
3	KESKO GROUP'S CORPORATE GOVERNANCE SYSTEM 3
4	BOARD OF DIRECTORS4
	4.1 TERM, COMPOSITION AND INDEPENDENCE4
	Term4
	Composition 5
	Independence 6
	4.2 MAIN DUTIES 6
	4.3 DECISION-MAKING, OPERATIONS AND MEETINGS7
5	BOARD COMMITTEES8
	5.1 AUDIT COMMITTEE AND ITS OPERATIONS9 5.2 REMUNERATION COMMITTEE AND ITS OPERATIONS10
6	PRESIDENT AND CEO11
7	DESCRIPTION OF THE MAIN FEATURES OF THE INTERNAL CONTROL AND RISK
	MANAGEMENT SYSTEMS PERTAINING TO THE GROUP'S FINANCIAL REPORTING 12
	7.1 GROUP'S FINANCIAL REPORTING AND INTERNAL CONTROL 12
	Kesko's management system12
	Roles and responsibilities12
	Planning and performance reporting13
	Key actions in 201213
	Key actions in 201314
	Accounting policies and financial management IT systems 14
	7.2 RISK MANAGEMENT14
	Risk management responses in 201215
	Focus areas of risk management in 201315
	7.3 INTERNAL CONTROL 16
8	INTERNAL AUDIT16
	Internal audit operations in 2012 17
	Focus areas of internal audit in 201317
9	AUDIT 17

This is the separate Corporate Governance Statement referred to in Recommendation 54 of the Finnish Corporate Governance Code issued by the Securities Market Association and effective 1 October 2010. This statement and the other information required by the Corporate Governance Code, the company's financial statements, the Report by the Board of Directors and the Auditor's Report are available on Kesko's website at www.kesko.fi/Investors.

KESKO CORPORATION'S CORPORATE GOVERNANCE STATEMENT

1 Rules and corporate governance observed by Kesko

Kesko Corporation (Kesko or the company) is a Finnish public limited company in which the duties and responsibilities of the executive bodies are defined according to the Finnish laws. The Kesko Group comprises the parent company, Kesko, and its subsidiaries. The company is domiciled in Helsinki.

Kesko's decision-making and corporate governance are guided by Kesko's values and responsible operating practices. Decision-making and corporate governance comply with the Finnish Limited Liability Companies Act, regulations concerning publicly quoted companies, Kesko's Articles of Association, the charters of Kesko's Board of Directors and its Committees and the rules and guidelines of NASDAQ OMX Helsinki Ltd. The company complies with the Finnish Corporate Governance Code for Listed Companies 2010 ("Corporate Governance Code"). The Code can be read in full at www.cgfinland.fi. As provided by the Comply or Explain principle of the Corporate Governance Code, the company departs from the Corporate Governance Code's recommendation concerning the term of a Board member.

2 Departure from Recommendation 10 of the Corporate Governance Code (Board members' term) and explanation for the departure

The term of Kesko's Board members departs from the term of one year given in Recommendation 10 - Term of the directors - of the Corporate Governance Code. The term of the company's Board is defined in the company's Articles of Association. The General Meeting makes decisions on amendments to the Articles of Association. According to the company's Articles of Association, the term of each Board member is three (3) years with the term starting at the close of the General meeting electing the member and expiring at the close of the third (3rd) Annual General Meeting (AGM) after the election.

A shareholder which, together with its related entities, holds over 10% of all votes carried by the Kesko shares, has informed the company's Board that it considers the term of three years good for the company's long-term development and has not seen any need to shorten the term provided in the Articles of Association.

3 Kesko Group's corporate governance system

The highest decision-making power in Kesko is exercised by the company's shareholders at the company's General Meeting. The company's shareholders elect the company's Board of Directors (Board) and auditor at the Annual General Meeting. The Kesko Group is managed by the Board and the Managing Director, who is the President and CEO. The

Helsinki 00016 KESKO

President and CEO is appointed by the Board. The company uses a so-called one-tier governance model.

4 Board of Directors

4.1 Term, composition and independence

Term

According to the Articles of Association, the term of a Kesko Board member is three (3) years, starting at the close of the General Meeting electing the member and expiring at the close of the third (3) AGM after the election.

According to the Articles of Association, Kesko's Board consists of a minimum of five (5) and a maximum of eight (8) members. All Board members are elected by the General Meeting. There are no special procedures concerning the nomination of Board member candidates or their election at the General Meeting, as the number of Board members is resolved and the Board members are elected by majority votes at the General Meeting based on shareholders' proposals. The Board elects the Chair and the Deputy Chair from among its members for the whole term of the Board.

Helsinki 00016 KESKO

Satamakatu 3 www.kesko.fi Kotipaikka Helsinki

Kesko Oyj Puhelin 010 53 11 Y-tunnus 0109862-8

Composition

The Board elected by Kesko's Annual General Meeting (AGM) held on 16 April 2012 is composed of seven (7) members:

Esa Kiiskinen, b. 1963, Business College Graduate Board Chair, Chair of the Remuneration Committee Food retailer Board member since 30 March 2009.

Seppo Paatelainen, b. 1944, Master of Science (Agriculture & Forestry) Deputy Chair of the Board, Deputy Chair of the Remuneration Committee and the Audit Committee Board member since 27 March 2006.

Ilpo Kokkila, b. 1947, Master of Science (Technology) Member of the Remuneration Committee Board Chair of SRV Group Plc Board member since 27 March 2006.

Tomi Korpisaari, b. 1968, Master of Science (Economics) Retailer, building and home improvement trade and agricultural trade Board member since 16 April 2012.

Maarit Näkyvä, b. 1953, Master of Science (Economics) Chair of the Audit Committee Board member since 1 January 2001.

Toni Pokela, b. 1973, Secondary School Graduate Food retailer Board member since 16 April 2012.

Virpi Tuunainen, b. 1967, Doctor of Science in Economics Member of the Audit Committee Professor at the Department of Information and Service Economy at Aalto University and Director of Aalto Service Factory Board member since 16 April 2012.

In accordance with the Articles of Association, the term of each Board member will expire at the close of the 2015 Annual General Meeting.

Helsinki 00016 KESKO

In 2012, the Board members also included Heikki Takamäki (Ch.), Mikko Kosonen and Rauno Törrönen until the close of the AGM held on 16 April 2012.

Independence

All of Kesko's Board members are non-executive directors. The Board evaluates the independence of its members annually on a regular basis in accordance with Recommendation 15 of the Corporate Governance Code. Based on the latest independence evaluation carried out on 16 April 2012, the Board considers that all of its members are independent of the company's significant shareholders, and that the majority of the members is also independent of the company. A Board member is obliged to provide the Board with sufficient information to enable the Board to evaluate his/her independence.

	Indepen-	Independent of significant
	dent of the
	company	shareholder
Esa Kiiskinen (Ch.*)	No***	Yes
Seppo Paatelainen (Dep. Ch.)	Yes	Yes
Ilpo Kokkila	Yes	Yes
Tomi Korpisaari*	No***	Yes
Maarit Näkyvä	Yes	Yes
Toni Pokela*	No***	Yes
Virpi Tuunainen*	Yes	Yes
Heikki Takamäki (Ch.)**	No***	Yes
Mikko Kosonen**	Yes	Yes
Rauno Törrönen**	No***	Yes

4.2 Main duties

Kesko's Board ensures that the company's administration, operations and accounting, as well as financial management controls are in place. It is also responsible for the supervision and control of the whole Kesko Group. The Board has confirmed a written charter for its duties, matters to be discussed, meeting practice and the decision-making procedure. In accordance with the charter, the Board considers and makes decisions on all matters that are financially, commercially or fundamentally significant for the Group.

As provided by the charter, the Board's main duties include:

• making decisions on the Group's strategy and confirming strategies for the divisions
• confirming the Group's rolling plan, which includes the capital expenditure plan
• approving the Group's financial and investment policy
• confirming the Group's risk management policy and considering the Group's most significant risks and uncertainties

Helsinki 00016 KESKO

• reviewing and adopting the consolidated financial statements, interim reports and related stock exchange releases and the report by the Board of Directors
• making decisions on strategically or financially significant individual capital expenditures, business acquisitions, disposals or arrangements, and commitments
• making decisions on management authorisation rules
• making decisions on the essential Group composition and organisation
• appointing and dismissing the company's President and CEO, approving his/her managing director's service contract and making decisions on his/her compensation and other financial benefits
• making decisions on the appointment of Corporate Management Board members responsible for lines of business, on their compensation and financial benefits
• making decisions on the principles of Kesko's remuneration plans and monitoring the implementation of the plans
• making possible proposals to the General Meeting for share or share-based compensation plans, and making decisions on granting shares or share options under share and share-based compensation plans, and on the terms and conditions for granting them
• establishing a dividend policy and being responsible for shareholder value performance
• confirming the company's values
• reviewing the Corporate Responsibility Report
• being responsible for the other statutory duties prescribed to the Board by the Limited Liability Companies' Act or some other, and for duties prescribed by the Finnish Corporate Governance Code.

4.3 Decision-making, operations and meetings

The duty of Kesko's Board is to promote the best interests of Kesko and all of its shareholders. The Board members do not represent the interests of the parties who have proposed their election as Board members. A Board member is disqualified from participating in the handling of any matter between him/her and the company. When a vote is taken, the Board's decision will be the opinion of the majority. If a vote results in a tie, the decision will be the opinion supported by the Chair. If the votes taken at an election of a person end in a tie, the result will be decided by drawing lots.

In 2012, the Board held 11 meetings. The Board members' attendance rate at the Board meetings was 98.7%.

In its strategy work in 2012, the Board continued to discuss the divisions' controlled expansion into Russia, monitored especially the progress of chain concept and business model development in the home and speciality goods trade, and continued to discuss electronic customer communications and e-commerce. The Board approved measures for adjusting to the uncertain economic situation by prioritising capital expenditures, among other things. In August 2012, the Board also decided to issue and list a €250 million bond. As in previous years, the Board reviewed the financial reports and monitored the Group's financial situation, approved the most significant capital expenditures in the operating countries, monitored the progress of Group-level projects and approved interim reports and the financial statements prior to their disclosure.

The Board meetings regularly include a review by the President and CEO on major topical issues, as well as reports by the Chairs of the Board's Audit Committee and Remuneration Committee on preparatory committee meetings preceding the Board

Helsinki 00016 KESKO

meetings. The auditor regularly presents his findings to the Board once a year in connection with the review of the financial statements.

The Board regularly assesses its operations and working practices and carries out a related self-assessment once a year. Most recently, the Board made a selfassessment of its operations and working practices in December 2012. In the assessment, the Board decided to place a special emphasis on monitoring the implementation of strategic projects.

	Board member since			Attendance
		Committee Board		Audit Committee	Remuneration Committee
Esa Kiiskinen (Ch.*)	2009	Remuneration Committee (Ch.) 11/11			3/3
Seppo Paatelainen (Dep.	2006			5/5	3/3
$\mathsf{Ch}$ .)		Audit Committee (Dep. Ch.)
		Remuneration Committee (Dep. Ch.)	11/11
Ilpo Kokkila	2006	Remuneration Committee	11/11		3/3
Tomi Korpisaari*	2012		9/9
Maarit Näkyvä	2001	Audit Committee (Ch.)	11/11	5/5
Toni Pokela*	2012		9/9
Virpi Tuunainen*	2012		8/9	3/4
Heikki Takamäki (Ch.)**	2001	Remuneration Committee (Ch.)	212		2/2
Mikko Kosonen**	2009	Audit Committee	2l2	1/1
Rauno Törrönen**	2009		2/2

5 Board Committees

Kesko has a Board's Audit Committee and a Remuneration Committee, both of which consist of three (3) Board members. At the close of the AGM, the Board elects the Chairs, the Deputy Chairs and the members of the Committees from among its members for one year at a time.

All members of the Audit Committee are independent of the company and the company's significant shareholders. In the election of the Audit Committee members, the relevant qualification requirements have been taken into account.

All members of the Remuneration Committee are independent of the company's significant shareholder and its majority is also independent of the company. In the election of the Remuneration Committee members, the relevant qualification requirements have been taken into account.

Helsinki 00016 KESKO

The Committees regularly assess their operations and working practices and carry out a related self-assessment once a year. The Board has confirmed written charters for the Committees that lay down their key duties and operating principles.

The Committees have no independent decision-making power. Instead, the Board makes decisions based on the preparatory work of the Committees. The Chair of the Committee reports on the work of the Committee at the Board meeting following a Committee meeting. The minutes of Committee meetings are submitted to the Board members for information.

Kesko's Board has not established any other committees in addition to the Audit and Remuneration Committees. Nor has the General Meeting established any committees or boards.

5.1 Audit Committee and its operations

The members of the Audit Committee, elected by the Board's organisational meeting held after the AGM 2012, are:

• Maarit Näkyvä (Ch.)
• Seppo Paatelainen (Dep. Ch.)
• Virpi Tuunainen.

According to its charter, the duties of the Audit Committee are:

• monitoring the Kesko Group's financial and funding situation and the process of financial statements reporting
• supervising the company's financial reporting process
• evaluating the efficiency of the company's internal control, internal audit and risk management systems
• reviewing the company's Corporate Governance Statement
• approving the operating instructions, annual audit plan, budget and resources of the company's Internal Audit and handling the reports submitted to the Committee
• monitoring the statutory audit of the financial statements and the consolidated financial statements
• evaluating the independence of the company's audit firm
• evaluating the non-audit services provided to Kesko by the audit firm and audit companies belonging to the same chain
• preparing the draft resolution concerning the election of the company's auditor to the General Meeting and contacts with the auditor.

In 2012, the Audit Committee held five (5) meetings, and its members' attendance rate at the meetings was 93.3%. At the Committee meetings, the Group's CFO, the Corporate Controller, the Chief Audit Executive and the General Counsel regularly report on their areas of responsibility to the Committee. The Committee also receives reports on the Kesko Group's funding situation, risk management and insurances. The auditor is present at the Committee meetings and presents his audit plan and report to the Audit Committee.

During the year, the Committee reviewed reports on the Group's financial situation, including the financial statements release and interim reports and made a recommendation to the Board on handling the interim reports and the financial statements release. In addition, the Committee reviewed the Group's external and internal audit, risk management and legal affairs reports. The Committee approved the updated internal control principles and the guidelines for malpractice investigation and reporting, as well as Internal Audit's

Helsinki 00016 KESKO

Satamakatu 3 www.kesko.fi Kotipaikka Helsinki

Kesko Oyj Puhelin 010 53 11 Y-tunnus 0109862-8

audit plan, budget and resources for 2013. The Committee also evaluated the auditor's independence and consultation services to the Group. The Audit Committee has prepared and submitted a proposal to the AGM on the auditor to be elected for Kesko. In its selfassessment in December 2012, the committee concluded that it was necessary to continue discussing the division of duties between the Committee and the Board in handling the financial statements, the financial statements release and the interim reports.

5.2 Remuneration Committee and its operations

The members of the Remuneration Committee, elected by the Board's organisational meeting held after the AGM 2012, are:

• Esa Kiiskinen (Ch.)
• Seppo Paatelainen (Dep. Ch.)
• Ilpo Kokkila.

According to its charter, the duties of the Remuneration Committee are:

• preparing matters pertaining to the compensation and other financial benefits of the company's President and CEO, and preparing the managing director's service contract to the Board
• preparing matters pertaining to the compensation and other financial benefits of the Corporate Management Board members responsible for lines of business; the President and CEO makes decisions on the compensation and other financial benefits of the other Corporate Management Board members within the limits set by the Chair of the Remuneration Committee
• preparing matters pertaining to the appointment of the President and CEO and the Corporate Management Board members responsible for lines of business, and identification of their possible successors
• developing and preparing remuneration plans for the company's Board, including:
• o evaluating the remuneration of the President and CEO and other management, and taking care of the appropriateness of the remunerations plans
• o preparing possible share or share-based compensation plans
• o preparing the granting of shares or share options under share or sharebased compensation plans, and preparing their terms and conditions
• o reviewing the remuneration statement in connection with the financial statements
• o answering questions concerning the remuneration statement at the General Meeting. Questions are primarily answered by the Committee Chair
• o preparing the principles for the performance and result criteria of the remuneration plans, and monitoring their implementation and evaluating their impact on Kesko's long-term financial success.

In 2012, the Remuneration Committee held three (3) meetings and the members' attendance rate at the meetings was 100%. The Committee prepared, among other things, proposals to the Board for the payment of share awards and for the principles of the management's performance bonuses. In its self-assessment discussion in December 2012, the committee decided to discuss management succession in more detail than before.

Helsinki 00016 KESKO

6 President and CEO

Kesko has a managing director who is the President and CEO. Kesko's President and CEO is Matti Halmesmäki, Master of Science in Economics, Master of Laws. He has been Kesko's President and CEO since 1 March 2005.

Matti Halmesmäki, b. 1952, Master of Science in Economics, Master of Laws. President and CEO since 1 March 2005 Member of the Corporate Management Board since 1 January 2001.

The President and CEO's duty is to manage the company in accordance with the instructions and orders issued by the company Board and to inform the Board about the developments in the company's business operations and financial situation. He is also responsible for the company's day-to-day management and that the financial affairs are handled in a reliable manner. The President and CEO also chairs the Corporate Management Board and the Boards essential with regard to business operations.

The President and CEO is elected by the Board, which has also made the decisions on the terms of the President and CEO's service contract. A written managing director's service contract, approved by the Board, has been made between the company and the President and CEO.

Helsinki 00016 KESKO

7 Description of the main features of the internal control and risk management systems pertaining to the Group's financial reporting

7.1 Group's financial reporting and internal control

Kesko's management system

Kesko's financial reporting and planning are based on the Kesko Group's management system. The Group units' financial results are reported and analysed within the Group on a monthly basis, and disclosed in interim reports published quarterly. Financial plans are prepared for quarterly periods, in addition to which significant changes are taken into account in the monthly performance forecasts. The Group's and its units' strategies and related long-term financial plans are updated annually.

Roles and responsibilities

The Kesko Group's financial reporting and its control is divided between three organisational levels. The subsidiaries analyse and report their figures to the respective divisions, which then report the division-specific figures to Corporate Accounting. Analyses and controls for ensuring the accuracy of reporting are used at each level.

Helsinki 00016 KESKO

Satamakatu 3 www.kesko.fi Kotipaikka Helsinki

Kesko Oyj Puhelin 010 53 11 Y-tunnus 0109862-8

The accuracy of reporting is ensured by using automated and manual controls at every reporting level. In addition, the income statement and balance sheet are analysed by controllers at subsidiary, division and Group level every month. The implementation of the analyses and controls is supervised on a monthly basis at company, division and Group level.

Planning and performance reporting

The Group's financial performance and the achievement of financial objectives are monitored via Group-wide financial reporting. Monthly performance reporting includes Group, division and subsidiary specific results, changes compared to the previous year, comparison with financial plans, and forecasts for the next 12 months. The Group's shortterm financial planning is based on plans drawn up by the quarter, extending for the following 15 months. The financial indicator for growth is sales performance, while that for profitability is the accumulation of economic value added, monitored via monthly internal reporting. In the calculation of economic value added, the requirements concerning return on capital are determined annually on market terms, and the return requirements take account of risk-related division and country specific differences. Information on the Group's financial situation is communicated in interim reports and the financial statements release. The Group's sales figures are published in a stock exchange release each month.

Financial planning takes place at the subsidiary, division and Group level as rolling plans, each for a 12-month period, are made. The plans are updated quarterly, and any significant changes are taken into account in the performance forecasts reported monthly. Any deviations between the plan and the actual results are analysed by the company, division and Corporate Accounting, and the reasons are reported to the division and Corporate Accounting every month.

The performance reports provided monthly for the Group's top management comprise the subsidiaries', divisions' and the consolidated income statements and balance sheets. Each subsidiary is primarily responsible for the financial reporting and the accuracy of its figures. The controlling function of each division analyses the whole division's figures for which the division's financial management is responsible. The Group is responsible for the whole Group's figures. The income statement and the balance sheet are analysed monthly at the company, division and Group level, based on the documented division of duties and specified reports. This makes real-time information on the financial situation constantly available, as well as real-time responses to possible defects. The performance reports provided for the top management also include Group level monitoring of sales on a weekly, monthly and quarterly basis.

Public performance reporting comprises interim reports, the financial statements release, annual financial statements and monthly sales reports. The same principles and control methods are applied to the public performance reporting as to the monthly performance reporting. The Audit Committee reviews the interim report and the financial statements and gives a recommendation on their approval to the Board. The Board approves each interim report and the financial statements before they are published.

Key actions in 2012

The Kesko Group continued the project for harmonising the financial management information systems, which serves both the Group companies and the K-Group's retailers. The resulting financial management system will be part of the Group's financial reporting

Helsinki 00016 KESKO

system. In addition, the K-Group's financial management processes and the control environment will become uniform.

The adoption of a shared planning system, which was begun earlier, was continued. The project will harmonise the Group companies' planning systems and integrate them into the Group's reporting system.

Key actions in 2013

In 2013, the financial management function will continue the information system project serving the K-Group and its adoption.

Accounting policies and financial management IT systems

The Kesko Group has adopted the International Financial Reporting Standards (IFRSs) endorsed by the European Union. The accounting policies adopted by the Group are included in the accounting manual, updated as the standards are amended. The manual contains guidelines for separate companies, the parent company, and guidelines for the preparation of consolidated financial statements.

The Kesko Group's financial management information is generated by division-specific enterprise resource planning systems, via a centralised and controlled common interface, into the Group's centralised consolidation system, to produce the Group's key financial reports. The key systems used in the production of financial information have been certified and secured by back-up systems, and they are controlled and checked regularly to ensure reliability and continuity.

7.2 Risk management

Kesko's risk management is proactive and an integral part of its management and day-today activities. The objective of risk management is to ensure the delivery of customer promises, profit performance, dividend payment capacity, shareholder value, the implementation of responsible operating practices and the continuity of operations in the Kesko Group.

The risk management policy confirmed by the Kesko Board guides risk management in the Kesko Group. The policy defines the goals and principles, organisation and responsibilities and the practices of risk management. The management of financial risks is based on the Group's finance policy, confirmed by Kesko's Board. The business division and Group unit managements are responsible for risk management implementation. Each division has appointed a management board member, usually the finance director, to be responsible for coordinating risk management and providing guidelines in each respective division, and reporting on risk management responses.

The Kesko Group applies a business-oriented and comprehensive approach to risk assessment and management. This means that key risks are systematically identified, assessed, managed, monitored and reported as part of business operations at the Group, division, company and unit level in all operating countries.

Kesko has a uniform risk assessment and reporting system. Risk identification is based on business objectives and opportunities and the defined risk appetite. Risks are prioritised on

Helsinki 00016 KESKO

the basis of their significance by assessing the impact and probability of their realisation and the level of risk management. When assessing the impact of realisation, the impacts on reputation, employees' wellbeing and the environment are considered in addition financial impacts.

In connection with the strategy process, the divisions assess the risks and opportunities concerning each strategic period. Near-future risks are identified and assessed in accordance with the rolling planning framework. Risk assessment also covers the risks concerning each division's subsidiaries and significant projects.

A division's risk assessment, which includes risk management responses, responsible persons and schedules, is discussed by the division's management board or the division parent company's Board quarterly prior to the disclosure of the interim report. The Group functions also assess the risks concerning their responsibility areas.

Risks and management responses are reported in accordance with Kesko's reporting responsibilities. The divisions report on risks and changes in risks to the Group's risk management function on a quarterly basis. Risks are discussed by the risk reporting team including representatives of the divisions and the Group functions. On that basis, the Group's risk management function prepares the Group's risk map, which presents the most significant risks and uncertainties and their management.

The Group's risk map, the most significant risks and uncertainties, as well as material changes in and responses to them are reported to the Kesko Board's Audit Committee in connection with handling the interim reports and the financial statements. The Audit Committee's Chair reports on risk management to the Board as part of the Audit Committee report.

Kesko's Board discusses the Kesko Group's most significant risks and the responses required to control them, and assesses the efficiency and effectiveness of risk management. The most significant risks and uncertainties are reported to the market by the Board in the financial statements, and material changes in them in interim reports.

Risk management responses in 2012

Kesko's risk management process is established and no significant changes took place in it in 2012. Risk management resources were increased in Russia and cooperation between business divisions and Group control was strengthened. The risk management, legal affairs and internal audit functions organised value discussions on Kesko's responsible operating principles in Kesko's subsidiaries.

The risk management function was involved in the project for the introduction of the new chip&pin payment terminals. Kesko's chains and online stores are now in compliance with the PCI standard. A project for enhanced user right management was launched in Kesko's various SAP environments.

Focus areas of risk management in 2013

The risk management function will continue working in close cooperation with other Group units, such as the internal audit, legal affairs, human resources, accounting, treasury and IT functions in order to ensure the adoption of, for example, responsible operating practices, to prevent malpractice, and to develop risk management related to personnel safety,

Helsinki 00016 KESKO

information security and data protection. In 2013, the SAP user right management project launched in the previous year will continue and its efficient use will be ensured.

Jointly with the divisions, the risk management function organises crisis exercises for the company's management and training sessions on safety and security. In addition, continuity planning, especially concerning premises critical for business operations, and concerning information management are developed.

7.3 Internal control

The objective of internal control in the Kesko Group is to ensure

• the profitability and efficiency of operations
• the continuity of operations
• the reliability of financial and operational reporting
• compliance with laws and agreements and Kesko's values and operating principles
• the security of assets and information.

Internal control is a part of Kesko's management, governance and day-to-day operations. The Board and the President and CEO are responsible for the organisation of internal control. The management of every division, company and unit is responsible for taking care that efficient and effective control procedures are in place. Management is also responsible for extending control to outsourced services.

Kesko's Group units guide and support the divisions and subsidiaries with policies, principles and guidelines pertaining to their respective responsibility areas.

The Audit Committee of Kesko's Board has confirmed Kesko's internal control policies, which are based on good control principles, widely accepted internationally (COSO).

Internal control refers to all preventive controls, as well as daily and subsequent control aimed to ensure the achievement of business objectives. Kesko's values, operating principles and the company's strategy and objectives form the basis of internal control.

Defining the focal areas of control is based on the identification of business threats and opportunities as part of Kesko's risk management operations. The divisions annually prepare control programmes, which contain, for example, the focal and development areas of control. Kesko's operating principles have been communicated to the Kesko employees in the guide 'Our Responsible Working Principles' and with a related Group-wide training programme.

The Kesko Group's internal audit function assesses and verifies the efficiency and effectiveness of Kesko's internal control and assists management and the Kesko companies in the development of the internal control system.

8 Internal audit

Helsinki 00016 KESKO

Kesko's internal audit function is responsible for the Group's independent evaluation and assurance function required of a listed company, which systematically examines and verifies the efficiency of risk management, control, management and governance. The Audit Committee of Kesko's Board has approved Kesko's internal audit function's operating instructions.

The internal audit function is organised under Kesko's President and CEO and the Audit Committee, and it reports on its findings and recommendations to the Audit Committee, the President and CEO, the management of the audited operation, and the auditor. The function covers all of Kesko's divisions, companies and functions. Auditing is based on risk analyses and risk management and control discussions with the Group's and divisions' managements. Meetings with the auditor are also arranged on a regular basis.

An internal audit plan, subject to approval by the President and CEO and the Audit Committee, is prepared annually. The annual plan is modified on a risk basis, if necessary. As necessary, the internal audit function purchases external services for added resources or for the purpose of conducting audit operations which require special competencies. Audits can also make use of the competence and work contribution of the Kesko Group's other specialists.

The internal audit function cooperates with the Group's risk management function and participates in the work of the Risk Management Steering Group. The internal audit function assesses the efficiency of Kesko's risk management system annually.

Internal audit operations in 2012

In 2012, the areas of emphasis of the internal audit function included Kesko's business operations in Russia and related risks, as well as significant business and IT projects. Other areas of emphasis included payment controls and malpractice risks. In the information system audit, special attention was paid to the progress and management of ongoing projects. Compliance with Kesko's accounting policies and reporting guidelines was verified and assessed in various audits, with an emphasis on the accuracy of inventory values and trade receivables. Close cooperation with the auditor was maintained in order to ensure a sufficient coverage of audit operations and to avoid overlapping operations.

Focus areas of internal audit in 2013

The key focus areas of internal audit operations in 2013 will be the business operations in Russia and related risks, as well as the basic controls, such as payment, store and proactive IT controls. Other focus areas include the ongoing business and IT projects, as well as the data security and controls of online stores.

9 Audit

According to the Articles of Association, Kesko has one (1) auditor, which shall be an audit firm authorised by the Central Chamber of Commerce. The Audit Committee prepares a proposal for the company's auditor to the AGM. The Audit Committee also evaluates the auditors' operations and services annually. The term of office of an auditor is the company's financial period and an auditor's duties terminate at the close of the AGM

Helsinki 00016 KESKO

following the election. As a rule, a network firm of the audit firm represented by the auditor elected by Kesko's General Meeting acts as the auditor of the Group's foreign subsidiaries.

The auditor presents the audit report required by law to Kesko's shareholders in connection with the company's financial statements and regularly reports its findings to the Audit Committee of Kesko's Board.

The 2012 General Meeting elected PricewaterhouseCoopers Oy, Authorised Public Accountants, as the company's auditor, with APA Johan Kronberg as the auditor with principal responsibility. The General Meeting resolved that the auditor's fee is paid and expenses are reimbursed according to invoice approved by the company.

Johan Kronberg KHT PricewaterhouseCoopers Oy The auditor with principal responsibility for Kesko since 31 March 2008.