Ponsse Oyj

Governance Information • Mar 15, 2023

Corporate governance statement 2022

Ponsse Plc

I Introduction3
II Ponsse's management and governance4
Annual General Meeting4
Board of Directors5
Tasks5
Activities5
Members6
Election criteria for Board members, and diversity in the Board of Directors9
Independence of the members 10
Committees11
President and CEO 11
Management Team12
Internal control 14
Distribution of responsibilities 15
Risk management17
Risk management process 17
Organisation and the distribution of responsibilities 19
Auditing of accounts20
Ponsse's insider lists21
Disclosure obligation for executives and related parties21
Trading restrictions22
Principles regarding related party transactions22

I Introduction

Corporate governance at Ponsse Plc (hereinafter also "the company" or "Ponsse") is based on existing legislation, Ponsse's Articles of Association and policies set by the company's administrative bodies. In addition, the company complies with the Financial Supervisory Authority's guidelines and regulations. The company's ethical values are described in more detail in Ponsse's Code of Conduct, available on the company's website.

Legislation obligates listed companies to compile an annual corporate governance statement. This statement has been prepared to correspond to the Corporate Governance Code for Finnish listed companies, which has been approved by the Board of Directors of the Securities Market Association and supplements legal obligations. It entered into force on 1 January 2020 and is available at www.cgfinland.fi. The Corporate Governance Code is based on the principle of comply or explain, according to which deviations from individual recommendations are possible for justified reasons. Ponsse complies with the Corporate Governance Code as a whole with the exception of Recommendation 10 issued for the independence of members of the Board of Directors. The main reason for deviating from the recommendation is Ponsse's history as a strongly family-owned company. The deviation is further explained below.

The statement has been issued as a document separate from the annual report, and the company's Board of Directors discussed and approved it at its meeting held on 2 March 2023. KPMG Oy Ab, the company's auditor, has also verified that the statement has been issued and that its description of the main features of internal control and risk management systems related to the financial reporting process are in line with the financial statements. The corporate governance statement and the remuneration report required by it will be made available on Ponsse's website at http://www.ponsse.com/fi/sijoittajat when the financial statements and the annual report are published. Other information related to the company's governance is also available on Ponsse's website.

The purpose of the corporate governance principles is to ensure ethical business principles and practices, as well as a high level of professionalism. This statement on the company's corporate governance system increases the transparency of operations, allowing shareholders to assure themselves that Ponsse is managed lawfully and efficiently and in the company's best interests. Good governance and clear governance principles serve both the company's management, and its shareholders and investors.

II Ponsse's management and governance

Ponsse Plc's business operations are the responsibility of the Annual General Meeting and the Board of Directors, as well as the Management Team chaired by the President and CEO.

Annual General Meeting

The Company's highest decision-making body is the Annual General Meeting, where shareholders have the right to speak, ask questions of the company management and vote. The Annual General Meeting is held once a year on a date determined by the company's Board of Directors, however, before the end of June. An extraordinary general meeting will be convened if the Board of Directors deems it necessary or if it is required by the auditor or shareholders who collectively hold at least one tenth of all shares. Meetings will be held in Vieremä, Iisalmi or Kajaani. Ponsse Plc's 2022 Annual General Meeting was held in Vieremä on 7 April 2022.

The most important matters to be decided at the Annual General Meeting include:

• approving the financial statements,
• electing the Board members and the auditor,
• deciding on fees for the Board members and the auditor,
• deciding on the discharge from liability of the members of the Board of Directors and the President and CEO,
• deciding on the distribution of the company's assets, and
• amending the company's Articles of Association.

The Annual General Meeting is convened by the company's Board of Directors. A notice about the Annual General Meeting is published on the Ponsse's website, and also, at the discretion of the Board, in a broad-circulation newspaper, no earlier than three (3) months and no later than twenty-one (21) days before the Annual General Meeting. The agenda and other documents relating to the Annual General Meeting

are made available on the company's website no later than twenty-one (21) days before the Annual General Meeting.

Ponsse's website contains more detailed information on the rights of shareholders to have a matter of concern to them dealt with at the Annual General Meeting, on the rights of shareholders to participate in the Annual General Meeting, and on other issues related to the Annual General Meeting.

Board of Directors

Tasks

The Board of Directors is the company's mandatory body, and its members are elected at the Annual General Meeting. The Board of Directors has general powers, including the appropriate arrangement of the company's governance and operations, as well as arranging the monitoring of accounting and asset management. In addition to internal governance, the Board of Directors is responsible for the disclosure policy and representing the company. The right to represent the company is set out in more detail in the company's Articles of Association.

In addition, key tasks of the Board of Directors include:

• reinforcing the long-term strategy and Ponsse Group's risk management policy,
• approving the budget,
• deciding on business and property transactions, strategically significant business expansions, equity investments, investment development and significant individual investments,
• appointing, and if necessary discharging, the President and CEO, and confirming the appointments of other members of the Management Team,
• deciding on salaries and remuneration for senior management, and
• assessing the management's activities annually.

Activities

The Board of Directors convenes regularly approximately ten times a year and at the invitation of the Chairman, as often as is required for proper handling of the company's affairs. Regular meetings of the Board of Directors include organising meetings and meetings related to the budget, strategy, interim reports and financial statements. The Board of Directors constitutes a quorum when more than half of its members are present at the meeting. The President and CEO has the right to attend meetings and exercise their right to speak, unless otherwise decided on by the Board of Directors. The President and CEO or another member of the company's management invited by the President and CEO also presents the matters to be discussed at each meeting.

In addition to being governed by legislation and the company's own Articles of Association, the work and activities of the Board of Directors are also governed by the Board's rules of procedure, which describe, among other things, the duties and meeting practices of the Board of Directors. Key matters to be discussed include progress reports and market, financial and financing reviews. The more detailed content depends on the purpose of each meeting.

For the effectiveness of risk management and activities, it is important that the Board has access to up-to-date and sufficient information on the company's operations, operating environment and financial position. Provision of this information is the responsibility of the President and CEO. In accordance with chapter 6, section 17, subsection 1 of the Limited Liability Companies Act, the President and CEO must supply the Board of Directors and the Members of the Board of Directors with the information necessary for carrying out their duties as Board members. Notwithstanding the President and CEO's disclosure obligation, each member of the Board also independently monitors the company's operations and finances.

The Board of Directors aims to regularly evaluate its own activities and working methods. This assessment can be carried out either as an internal self-assessment or by an external evaluator. The assessment focuses on any problems that may have arisen in the activities of the Board, relating to such matters as the composition of the Board, the effectiveness of the Board's activities, and the Board's activities as a group. For 2022, the Board of Directors conducted a self-assessment in January 2023.

Members

According to Ponsse's Articles of Association, the Board of Directors must have at least five and at most eight members. The members of the Board of Directors are elected for a term that ends at the end of the Annual General Meeting of the following year. The Board of Directors is elected annually to allow shareholders to regularly evaluate the activities of the Board of Directors and its members. Proposals for the members of the Board of Directors and the fees payable to them are prepared by shareholders who represent more than fifty (50) per cent of the company's shares and votes. New members will be provided with induction regarding their tasks to the appropriate extent, considering their background and experience. The Board of Directors elects a Chairman from among its members.

In 2022, the governance of the company and the proper organisation of its operations were handled by an eight-member Board: Jarmo Vidgren (Chair), Mammu Kaario (Vice Chair), Matti Kylävainio, Ilpo Marjamaa (from 7 April 2022), Juha Vanhainen, Janne Vidgren, Juha Vidgren and Jukka Vidgren. The Board convened 14 times in 2022. The members participated actively in the meetings, with the average participation rate being 94.4%. During 2022, the Board of Directors focused on operations in the extremely challenging market situation and the withdrawal of operations from Russia.

Member	Year of birth	Education	Main function	Member of the Board since	Shareholdings on 31 December 2022
Jarmo Vidgren, Chairman of the Board	1975	Marketing diploma	Ponsse Plc, Chairman of the Board	2020	3,684,263 shares
Mammu Kaario Vice Chairman of the Board	1963	Master in Law with court training, MBA	Professional board member	2010	4,500 shares, independent of the company and of major shareholders
Matti Kylävainio	1974	Master of Science in Economics and Business Administration	Keitele Group, director of sawmill operations	2016	0 shares, independent of the company and of major shareholders
Ilpo Marjamaa	1961	Master of Science in Technology, Production Technology	Ponsse Plc, member of the Board	2022	0 shares, independent of the company and of major shareholders
Juha Vanhainen	1961	Master of Science in Technology	Ponsse Plc, member of the Board	2018	0 shares, independent of the company and of major shareholders
Janne Vidgren	1968	Vocational Qualification in Business and Administration	Ponsse Plc, member of the Board	2015	3,691,742 shares Independent of the company

Juha Vidgren	1970	Master of Educational Sciences	Ponsse Plc, member of the Board	2000	6,207,000 shares Independent of the company
Jukka Vidgren	1983	Media diploma	Mutant Koala Pictures, Managing Director	2011	3,764,778 shares Independent of the company

Participation of Board members in meetings in 2022

Member	Total participation (times)	Participation rate (%)
Jarmo Vidgren	14/14	100
Mammu Kaario	14/14	100
Matti Kylävainio	12/14	86
Ilpo Marjamaa (elected at the 2022 AGM)	10/10	100
Juha Vanhainen	14/14	100
Janne Vidgren	10/14	71
Juha Vidgren	14/14	100
Jukka Vidgren	14/14	100

Election criteria for Board members, and diversity in the Board of Directors

The elected members of the Board of Directors must have the competence required for the position and the opportunity to allocate a sufficient amount of time for working in the Board. The members must be willing to dedicate themselves to Ponsse, and they must conform to the company's values. The provisions of the Limited Liability Companies Act apply to the general eligibility criteria. No special eligibility criteria, such as an upper age limit, have been set in the Articles of Association for the members.

Overall, the members of the Board of Directors are required to have a sufficiently diverse expertise and the ability to carry out their tasks effectively. Key factors include that education and experience supplement those of other members. When considering the number of members, focus will be placed on Ponsse's operational goals and resulting requirements: the number of members must be relative to the company's size, line of business, market position and development stage. In addition, the shareholders' opinions must be addressed.

Diversity in the Board of Directors promotes an open culture of discussion and the ability to adopt an open approach to innovative ideas. Diversity is supported by the consideration of the age and gender distribution, educational backgrounds, as well as work and international experience. It benefits the company as a whole that individuals whose skills, backgrounds and views differ from one another are appointed as Ponsse's managers. This ensures the development of business and responsibility, as well as good corporate governance. The company's long-term goal is to increase diversity in the Board of Directors even further.

During the 2022 financial period, both genders were represented in Ponsse's Board of Directors, as in previous years. The eight-member Board had one female member. Educational and work backgrounds covered such areas as finances, legal affairs, technology, internationalisation, strategy, and marketing and sales, and the members also worked broadly in other positions of trust. Presentations of the Board members are also available on the company's website.

Independence of the members

According to Recommendation 10 of the Corporate Governance Code, a majority of the members of the Board of Directors must be independent of the company, and at least two independent members of the Board of Directors must also be independent of the company's major shareholders. Four of the company's eight-member Board of Directors are independent of the company and of its major shareholders. Six of the members are independent of the company. One member is dependent on the company and its major shareholders.

According to the estimate of the Board of Directors, the Board members that were independent of the company and of its major shareholders were Mammu Kaario, Matti Kylävainio, Ilpo Marjamaa and Juha Vanhainen. Of the members, Janne Vidgren, Juha Vidgren and Jukka Vidgren are independent of the company. Mammu Kaario, Juha Vidgren and Jukka Vidgren have been Board members for more than ten years without any interruptions. Based on the Board of Directors' overall assessment, the independence of the Board members has not been at risk due to the long-term membership, and no other factors have been identified that would reduce their independence.

The independence of the members is assessed by the Board of Directors using the independence criteria defined in the recommendation. To carry out the assessment,

the members must provide the Board with sufficient information to evaluate their independence, report any changes in the information and present their own estimates of their independence. If there is a change in the level of independence of a given Board member during the operating period, this information will be updated on the company's website. Each candidate for the Board must provide sufficient information on and estimates of their independence for the major shareholders who prepare the proposal for the composition of the next Board of Directors.

Committees

The tasks of the Board of Directors have not been specifically distributed between the Board members, and no committees have been set up for the preparation of matters that are within the scope of the Board's responsibilities. The Board of Directors has not formed an audit committee from amongst its members, nor has it delegated the duties of an audit committee to any other body. The Board of Directors is responsible for tasks of this type, such as:

• monitoring the auditing of accounts, preparing the proposal for the choice of auditor, and monitoring and evaluating the independence of the auditor and the supply of additional services,
• monitoring and evaluating the financial reporting system,
• monitoring and evaluating the effectiveness of internal control, internal audit and risk management systems, and
• management of the main features of internal control and risk management systems related to the financial reporting process included in the corporate governance statement.

Successive Boards of Directors of the company have repeatedly held that there it has not currently been necessary to set up committees, given the number of members of the Board of Directors and their effective performance. The Board has been able to properly carry out the duties that would otherwise be assigned to an audit committee. If the situation changes in the future and the Board of Directors considers it necessary to set up a committee, the Board may decide to set up an audit or remuneration committee, for example. In this case, the Board will elect at least three (3) of its members to the committee, and it will confirm the committee's key operating principles and tasks in the written rules of procedure.

President and CEO

The Board of Directors appoints and, if necessary, discharges Ponsse Plc's President and CEO. Since 1 June 2008, the President and CEO of the company has been Juho Nummela (born 1977). The President and CEO assists the Management Team.

The President and CEO carries out the company's daily governance in accordance with the guidelines and instructions issued by the Board of Directors. The President and CEO is responsible for ensuring that the company's accounting complies with the law and that its asset management has been arranged reliably. In addition to these tasks, the President and CEO:

• is responsible for the operational management of the company's business operations,
• provides the Board of Directors and the members of the Board with the information necessary for carrying out their duties,
• acts as rapporteur at Board meetings, and
• is responsible for the implementation of decisions taken by the Board of Directors.

The contract signed between the President and CEO and the company may be terminated by either party. The period of notice is six (6) months. If the company terminates the contract, the company will pay a remuneration equalling 12 months' salary in addition to the salary and other benefits that have been determined for the period of notice. The President and CEO is within the scope of the performance bonus scheme, with a performance bonus based on the performance targets approved by the Board. More information on the remuneration of the President and CEO is available in Ponsse Plc's remuneration report.

Management Team

The Company's management organisation includes the Management Team, each member of which has their own clear area of responsibility based on key operating units. The Management Team consists of President and CEO Juho Nummela as the Chairman and other directors appointed by the company's Board of Directors: Petri Härkönen, CFO and deputy President and CEO; Juha Inberg, Technology and R&D Director; Marko Mattila, Sales, Marketing and Service Director; Tapio Mertanen, Service Director; Paula Oksman, HR Director (until 31 December 2022); Tiina Kautonen (from 1 January 2023); Miika Soininen, Director of Digital Services and IT; and Tommi Väänänen, Supply Chain Director.

The primary task of the Management Team is to assist the President and CEO. As a rule, the Management Team convenes once a week, but at least once a month. The matters to be discussed may concern the following year's action plan or a long-term strategy. The Management Team's activities are operational in nature. It monitors and reviews from time to time the company's internal policies and procedures, including reporting, financial management, investments, risk management, insurance policies, information systems, general procurement, industrial property rights, contractual risk management, human resources management, environmental matters, work safety, insider guidelines, and communication. The Management Team has a significant position in the company's management organisation, the preparation of strategies, and decision making.

Members of the Management Team and their respective shareholdings on 31 December 2022

Management Team member	Title	Education	Management Team member since	Employed by the company since	Shareholdings on 31 December 2022
Juho Nummela b. 1977	President and CEO, Chairman of the Management Team	D.Sc. (Computer science)	2 January 2005	2002	62,541 shares
Petri Härkönen b. 1969	CFO, deputy CEO	M.Sc. (Eng.)	1 October 2009	2009	7,670 shares
Juha Inberg b. 1973	Technology and R&D Director	D.Sc. (Tech.)	1 January 2009	2003	12,796 shares
Marko Mattila b. 1973	Sales, Marketing and Service Director	Forest engineer, MBA	1 June 2020	2007	722 shares

Tapio Mertanen b. 1965	Service Director	Technician, maintenance technology development	3 May 2010	1994	1,200 shares
Paula Oksman b. 1959	HR Director, Director of Ponsse Academy	MA	1 August 2005	2005	4,436 shares
Miika Soininen b. 1981	Director, Digital Services and IT	Student of technology	1 December 2020	2018	180 shares
Tommi Väänänen b. 1973	Director, Supply Chain	BA (Eng.)	1 October 2013	2013	6,416 shares

III Control system

This corporate governance statement describes the framework and main principles of internal control and risk management. The primary responsibility for defining the operating principles and arranging control rests with the company's Board of Directors.

Internal control

Internal control involves the strategic and realistic planning of operations and finances, the monitoring and continuous evaluation of operations, and responding to deviations. Internal control encompasses all of the company's policies and practices that are aimed at ensuring the effectiveness of operations and economic efficiency and profitability. Internal control is ultimately a matter of risk prevention and quality management.

Internal control is not an end in itself. The key concern is that the internal control system and the risk management functions it includes function well, and that the overall purpose of internal control is fulfilled – namely, the achievement of the objectives and goals that have been set for the company's operations. Ponsse Plc's Board of Directors has also approved this operating principle.

Other purposes of internal control are to ensure that:

• decision making by the company's management is based on the correct, sufficient and reliable information,
• the company's operations are in line with the company's corporate principles and its Code of Conduct,
• the company's operations are in accordance with the law, with official regulations, and with the decisions of the company's bodies, and
• resources are used efficiently, while safeguarding assets.

Internal control is not a separate function, but an integral part of the company's daily activities, covering all levels and processes. Internal control does not merely constitute financial control, even though the financial perspective plays a key part. It equally concerns the appropriate and balanced distribution of tasks. This means that every employee's input must contribute to the achievement of the goals set for the company and its internal control.

Ponsse Group is committed to carrying out its business sustainably and responsibly. Responsibility is based on the company's values: integrity, innovation, the Ponsse spirit, and customer orientation. The Code of Conduct consists of guidelines related to Ponsse's business environment, employees, partners and society. These factors are also addressed in internal control. Employees are encouraged to report any suspicions of rule violations or unethical activities. In 2020, Ponsse deployed a whistleblowing system, through which employees and external stakeholders can unanimously report any identified misuse. A team appointed by the company's Board of Directors investigates all reported cases, and if necessary, forwards any identified shortcomings to the Management Team or the Board of Directors.

Internal auditing supports management, and it audits not only internal control and risk management, but also good corporate governance. The company has appointed an internal auditor who defines the focus of auditing each year together with the Board of Directors and reports auditing results regularly to it.

Distribution of responsibilities

The control environment forms the basis of internal control. The control environment includes operating instructions that guide Ponsse Group's operations, such as governance principles, the Code of Conduct and the policies required, such as the company's disclosure policy. Simply put, internal control in Ponsse Group means ensuring that each person and body carries out their tasks professionally, diligently and in a timely manner, and complies with given instructions and approved practices. Persons employed by the Group not being aware of the control environment is a risk in itself, which is why the primary responsibility for internal control rests with the company's management, which actively monitors the effectiveness of internal control using the activities of internal auditing.

The management of the company, or any specific separately determined responsible party, ensures open and timely communication so that the Board of Directors has access to sufficient and up-to-date information for decision making. The reliability of financial reporting, in particular, is ensured by focusing on the distribution of tasks and responsibilities. Each responsible party must be aware of guidelines and comply with them. Reliable financial reporting also involves auditing, which ultimately ensures the accuracy and completeness of financial information. The aforementioned applies to Ponsse Group as a whole, not only to the parent company's management.

The President and CEO, the members of the Management Team, and the directors of the subsidiaries are responsible for the lawfulness of the accounting and administration of their respective areas of responsibility and compliance with the company's guidelines.

Party	Role of internal control
Board of Directors	- Ensures that the company's accounts, asset management and risk management control are appropriately arranged and lawful. - Works with the President and CEO to ensure that the company operates in accordance with its values. - Approves the risk management policy, as well as operating guidelines in accordance with internal control and the Corporate Governance Code.
President and CEO	- Is responsible for the day-to-day management of the company in accordance with the instructions of the Board of Directors. - Creates the basis of internal control by guiding and instructing the senior management, and monitoring how they control their own operations.
Management Team	- Is responsible for ensuring compliance with the company's internal control guidelines and practices, particularly those linked to risk management and financial management.

Financial management	- Helps to create appropriate control practices for risk and financial management. - Monitors the sufficiency and effectiveness of control measures at a practical level.
Internal	-
auditing	Assesses and verifies the functioning of the control system.

Risk management

A risk is any potential event or chain of events that manifests itself as uncertainty with regard to achieving the company's objectives, or that threatens the continuity of business operations. A deviation from the set goal may be negative, or positive. In other words, risks represent uncertainties, while referring to both threats and opportunities. Risks and opportunities are an inseparable part of business activities, and effectiveness often requires well-considered risk taking and the courageous use of opportunities. Even though harmful risks cannot be fully avoided, the probability and impact of their realisation can be reduced and prepared for. As a result, risk management is part of normal daily business activities.

In practice, risk management means procedures included in the management system that help to identify and assess any uncertainties associated with the Group's operations, prepare for risks and seize opportunities. Risk management is vital to ensuring and safeguarding the company's operating conditions and performance. Furthermore, risk management is part of internal control so that the implementation of internal control also promotes the implementation of risk management. Risk management should not be separated from internal control, as internal control activities ultimately comprise the prevention of risks.

Ponsse Plc's risk management practices are based on the company's values, and its strategic and financial goals. The company's key strategic goals include social, financial and environmental responsibility in operations. The fulfilment of responsibilities is monitored regularly, and responsibility goals are monitored using key indicators. The company's responsibility activities are described in the annual responsibility report published together with the annual report.

Risk management process

The overall purpose of risk management processes is to support the achievement of the goals that are set out in the company's strategy, to safeguard the continuity of the company's financial development and business operations, and to maintain and

develop a comprehensive and pragmatic system for risk management and reporting. Risk management focuses on prevention: the aim of the process is to identify and assess key risks and prevent them from being realised.

Decisions on the actions required are made using assessments based on probabilities. Primary risk management measures include the avoidance, reduction, transfer and control of risks, as well as their controlled acceptance. The risk management process also includes the continuous assessment and monitoring of risks.

Key factors in effective risk management include

• the realistic assessment of risks,
• the timely assessment of risks,
• awareness of risks the personnel must be aware of risk management principles to act according to instructions and, above all, react as required by the situation, and
• comprehensiveness risk management is part of every activity, while it plays a specifically significant part of processes that are vital for the company's operations.

The special characteristics of different risk management processes vary depending on the nature of risks. Risks are divided into four categories: strategic, operational, financial and accident risks. Strategic risk refers to the nature of business operations, the choice of strategy, and the risk associated with the implementation of the strategy. If realised, strategic risks can significantly weaken the company's operating conditions. For example, strategic risks are associated with the prevailing competitive situation and regulations on companies' activities, and they may be realised in conjunction with significant investments. In its revised risk management process, the company has placed more focus on risks and opportunities associated with the environment and social and financial responsibilities from the perspectives of strategic, operational, financing and accident risks.

Operational risks are associated with the company's internal processes, such as the company's management, personnel or business network. If realised, operational risks may reduce operational efficiency and, therefore, the company's results and profitability.

Financial risks include currency, interest, credit and liquidity risks, as well as capital management risks. The goal of financial risk management is to protect Ponsse Group's financial performance, cash flow, equity and liquidity against unfavourable fluctuations in financial markets. Financial risk management is centralised in the parent company's financial unit. The Board of Directors confirms the company's financial risk management policy, and the company's CFO is responsible for its practical implementation together with the financial unit.

Accident risks are a more concrete threat to the company's operations than the aforementioned types of risks. In the management and avoidance of accident risks, main focus is placed on the identification of risks. Identified accident risks include occupational health and safety risks, environmental risks and risks of property

damage. Focus is also placed on prevention: accident risks have been prepared for through an extensive insurance scheme. In addition, the aim is to prevent accidents through a safety policy and guidelines, as well as safe working methods and tools. The company is very attentive to hazardous situations, and is quick to respond to them. Increased attention is now being given to personnel safety matters. All accidents and near-miss incidents are recorded in the monitoring system, and necessary measures are taken to prevent any hazards. The company's goal is an accident-free working environment. Accident risks are regularly assessed at the entire personnel's level.

Organisation and the distribution of responsibilities

The main responsibility for the organisation of risk management rests with the company's management. The Board of Directors defines and confirms the risk management policy and risk management principles, and it also assesses the fulfilment and effectiveness of processes. However, responsibilities are not only limited to the senior management: Every individual employed by the Group is obligated to anticipate risks and prevent their realisation. At an individual level, risk management takes place by reporting any identified risks to supervisors.

The risk management process includes the systematic identification and assessment of function- and unit-specific risks, and making sure that they are reflected in the company's risk management plan. Risk management is systematically implemented and monitored as part of daily activities. The company aims to improve the efficiency of its risk management by increasing awareness of its significance and supporting shared risk management projects of different functions.

Body, responsible party	Task
Board of Directors	Decides on the objectives and principles of risk management, and reinforces the company's risk management policy. Supervises the implementation of risk management.
President and CEO	Is responsible for organising the implementation of risk management, and presents matters related to risk management to the Board of Directors.
Management Team	Participates in the control of the risk management process and setting responsibilities for it. Each member of the Management Team is responsible for identifying risks in their own area of business operations, and for implementing risk management.
CFO	Coordinates the risk management process, and is responsible for reporting and presenting risk management matters to the Management Team.
Area directors and managing directors of subsidiaries	Each area and subsidiary independently carry out risk management in accordance with Ponsse Group's risk management policy and guidelines.

Employees	Every employee is obligated to take action to prevent risks, to comply with the company's guidelines, and to report any risks they detect to their supervisor.
Internal auditing	Supports the risk management process through assessments and assurances. Facilitates the process, ranging from the identification of risks to the monitoring of measures.

Auditing of accounts

The auditor's task is to verify the company's accounting, financial statements, annual report and administration for the financial period. The auditor assesses whether the financial statements give a true and fair view of the company's results and its financial position at the end of the financial period. The company's financial period is the calendar year. The audit also involves examining the consolidated financial statements. The parent company's auditor must ensure that the auditors of each of the companies belonging to the Group have properly conducted their audits. The auditor presents the auditor's report to the Annual General Meeting every year.

The company has one auditor, which must be a public accounting firm authorised by the Central Chamber of Commerce. It is also required that the auditor is independent of the company. At the Annual General Meeting held on 7 April 2022, auditing firm KPMG Oy Ab was elected as the company's auditor and Ari Eskelinen, authorised public accountant, was elected as the principal auditor. The auditing of accounts of foreign subsidiaries belonging to Ponsse Group has been arranged in accordance with the laws and other regulations of each country, but under the guidance of the company and KPMG Oy Ab.

In 2022, the Group's auditing costs amounted to EUR 284,272. The auditing fee paid to the company's auditing firm, KPMG Oy Ab, was EUR 111,800. Companies belonging to the KPMG chain were paid a fee of EUR 26,400 for services not directly related to auditing: certificates and statements (EUR 7,000), tax advice (EUR 3,100), and other fees (EUR 16,300). Other auditing firms were paid a total of EUR 110,355. This amount consisted of an auditing fee (EUR 35,750), certificates and statements (EUR 3,572), tax advice (EUR 16,605), and other fees (EUR 54,428).

IV Insider management

Ponsse adheres to the insider guidelines of Nasdaq Helsinki Ltd (insider guidelines for the stock exchange). The company's Board of Directors has also confirmed Ponsse

Insider information is information that is accurate and unpublished, and that directly or indirectly concerns Ponsse or Ponsse's financial instruments. Such information would, if disclosed, be likely to have a significant impact on the price of Ponsse's financial instruments, or on the price of associated derivative financial instruments. An example of insider information is previously unpublished information on Ponsse's results and significant changes in its financial position. The use and disclosure of insider information is not permitted in any situation. This prohibition applies to the company's permanent insiders and also to all persons who possess insider information, regardless of where or how that information was obtained. The disclosure of insider information and the postponement of any such disclosure are discussed in Ponsse Plc's disclosure policy, which is approved by the Board of Directors. The policy is available on the company's website.

Ponsse's insider lists

With the entry into force of the European Union market abuse regulation on 3 July 2016, the conditions for insider dealing have changed. As a result of these changes, Ponsse Plc no longer has public insiders, nor does it maintain a permanent companyspecific insider register. For this reason, the information on the company's website concerning the insider register has not been updated since 2 July 2016.

Insider lists are key instruments for the regulation of insider administration, and they must be maintained regarding permanent and project-specific insiders. Permanent insiders have a continuous access to all insider information on Ponsse as a result of their position or work. Permanent insiders include the members of the Board of Directors, the President and CEO, the deputy CEO, the CFO, the internal auditor, the secretary of the Board of Directors, and the executive assistant. Project-specific insider lists include those who have access to insider information in conjunction with a certain project.

Disclosure obligation for executives and related parties

Ponsse's executives and their related parties are obligated to notify Ponsse and the Finnish Financial Supervisory Authority of transactions they have made with the company's financial instruments. Executives include the members of the Board of Directors, the President and CEO, and the members of the Management Team. The disclosure obligation also applies to the related parties of executives. Transactions

must be reported to the company and to the Financial Supervisory Authority without delay, and no later than within three (3) business days of the transaction. The company will publish any reports received as stock exchange releases no later than within two (2) business days after receiving the report.

Trading restrictions

No members of Ponsse's senior management are permitted to carry out transactions with Ponsse's financial instruments, either directly or indirectly, either on their own behalf or on the behalf of a third party, for a period commencing 30 days prior to the publication of each financial statements bulletin and interim report, and ending on the day after the disclosure of such information. The company will separately notify those within the scope of trading restrictions of any situations where a financial statements bulletin does not exceptionally include all relevant information on the company's financial standing. In this case, the closed window will be expanded to 30 days before the publication of financial statements.

Trading with Ponsse's financial instruments is permitted at all other times, provided that the person making the transaction has not, at that time, been entered on a projectspecific list of insiders, or provided that the person has no other insider information.

The market abuse regulation requires that it is possible to report any suspected violations of provisions and regulations on financial markets. In addition, the proper handling of reports must be ensured. Accordingly, Ponsse has an ethical whistleblowing channel through which the personnel can report any suspected violations of insider regulations in confidence. It is also possible to give feedback anonymously. The company introduced the policy required by the regulation in 2017.

Principles regarding related party transactions

Related party transactions mean agreements or other legal actions between the company and its related parties. Related parties mean the related parties of listed companies as laid down in the Limited Liability Companies Act (IAS 24). The nature of related party transactions and their terms and conditions must be assessed particularly in relation to the company's ordinary course of business and customary market terms.

Ponsse does not normally enter into transactions with its related parties that would be significant for the company and deviate from the ordinary course of business or would be conducted in deviation from customary market terms. Any related party transactions will be handled by the company's Board of Directors, which also confirms principles governing related parties. Any regulations on disqualification will be addressed in decision making. The company defines its related parties and maintains a list of these. The financial management and legal affairs units monitor related party

transactions and provide related parties with guidance on matters associated with them. Related party transactions are reported in the financial statements.

The disclosure of related party transactions and other matters pertaining to the disclosure obligation are described in the guidelines on the disclosure policy confirmed by the company's Board of Directors. These are available on the company's website. In 2022, Ponsse Plc had no related party transactions that were relevant or that deviated from the ordinary course of business or from customary market terms.