AI Terminal

MODULE: AI_ANALYST
Interactive Q&A, Risk Assessment, Summarization
MODULE: DATA_EXTRACT
Excel Export, XBRL Parsing, Table Digitization
MODULE: PEER_COMP
Sector Benchmarking, Sentiment Analysis
SYSTEM ACCESS LOCKED
Authenticate / Register Log In

SSH Communications Security

Governance Information Mar 2, 2018

3344_cgr_2018-03-02_8c9120c3-78b1-4356-89e4-f890fe7f9a2a.pdf

Governance Information

Open in Viewer

Opens in native device viewer

SSH COMMUNICATIONS SECURITY CORPORATION

CORPORATE GOVERNANCE STATEMENT

MARCH 3, 2018

CORPORATE GOVERNANCE STATEMENT 2017 OF SSH COMMUNICATION SECURITY

SSH Communications Security Group comprises of SSH Communications Security Corporation ("SSH") and its subsidiaries. SSH is registered in Helsinki, Finland and is a publicly listed company in Nasdaq Helsinki (SSH1V). Its subsidiaries are SSH Communications Security, Inc. (USA), SSH Government Solutions, Inc. (USA), SSH Communications Security Limited (HK), SSH Communications Security UK Limited (UK), Kyberleijona Ltd. (FIN), SSH Technology Ltd. (FIN) and SSH Operations Ltd. (FIN) which has a branch in Germany. In addition, SSH had subsidiaries in Japan (SSH Communications Security K.K) and Singapore (SSH Communications Security PTE), but these entities were dissolved during 2017 and APAC operations are now focused to SSH´s HK office.

SSH abides by its Articles of Association as well as principles of transparent and responsible corporate governance, and high ethical standards in its governance and decision-making. The company complies with the Finnish Limited Liability Companies Act, securities market legislation, including the market abuse regulation, rules of Nasdaq Helsinki and Finnish Corporate Governance Code 2015 adopted by the Securities Market Association. This Code is available at www.cgfinland.fi.

In 2017, SSH departed from Recommendation 8 of the Corporate Governance Code as the Board of Directors, elected in the Annual General Meeting 2017, does not have both genders represented. This will be taken into account in the preparation of the proposal for the composition of the Board to be given to the Annual General Meeting 2018, so that the diversity of the next Board can be ensured. Departure from Recommendation 8 is also addressed at https://www.ssh.com/investors/board-andmanagement under Board Composition.

Furthermore, after the appointment of board member Kaisa Olkkonen as new CEO in December 2016, majority of the Board members were considered non-independent of the company which was a temporary exception to Recommendation 10 of the Corporate Governance Code. In the current Board of Directors, elected in the AGM 2017, majority of the Board members are considered independent of the company.

This Corporate Governance Statement is published as a separate report from the Report of the Board of Directors at SSH's website www.ssh.com.

SSH COMMUNICATIONS SECURITY'S ADMINISTRATIVE BODIES

SSH implements a one-tier governance model, where the management of the SSH Group is a responsibility of the General Meeting of shareholders, the Board of Directors, and the CEO. Duties are defined by the Finnish Limited Liability Companies Act and company´s Articles of Association.

The General Meeting is where shareholders exercise their voting rights and is SSH's highest decisionmaking body taking decisions on matters falling within its competence by virtue of the Limited Liability Companies Act and the Articles of Association.

The Annual General Meeting (AGM) elects the Board of Directors, which in turn appoints the CEO. The Board of Directors and CEO are responsible for the management of the Group. The Executive Management Team and other management personnel assist the CEO in his duties. The Board of Directors decides on the Group's administrative systems and ensures compliance with good governance principles.

ANNUAL GENERAL MEETING

The Annual General Meeting is held within six months of the completion of the company's fiscal year, at a time decided by the Board. The AGM decides on matters as required in the provisions of the Limited Liability Companies Act and Articles of Association, such as adoption of the year-end financial statements, profit distribution, and the granting of discharge from liability to the members of the Board of Directors and to the CEO. The AGM also elects the members of the Board of Directors and the auditors and decides their remuneration. Extraordinary general meeting can be called as defined in Limited Liability Companies Act. Each SSH share conveys one vote at the shareholder's meeting. Shareholders have the right to have a matter falling within the competence of the general meeting under the Limited Liability Companies' Act to be addressed at the general meeting.

BOARD OF DIRECTORS

In accordance with the company's Articles of Association, the Annual General Meeting appoints three to eight members to the Board of Directors. Their term of office ends with the closing of the next Annual General Meeting following their appointment. The Board has a quorum when more than half of its members are present. The company's Articles of Association do not restrict the members' terms in office or present any specific selection criteria for the members. The Board elects a chairperson from among its members.

SSH has established principles on diversity in accordance with the Corporate Governance Code's recommendation number 9. SSH has, and aims to continue to have in the future, members of the Board of Directors representing both genders as well as different professional and educational backgrounds. SSH's principles on diversity are taken into account when considering nominations to the Board of Directors. Decisions on the election of directors shall always be made at the general meeting.

The Board of Directors handles the company's administration and the appropriate arrangement of its operations. The Board also ensures that the supervision of the bookkeeping and asset management is appropriate. The Board makes wide-ranging and strategically important decisions concerning the company. The Board's task is to steer the company's operations in a manner that will add the greatest possible value to the company's invested capital over the long term.

The Board of Directors has confirmed a written charter for its duties, the matters it deals with, meeting practice and the decision-making procedure. In accordance with the charter, the Board deals with and makes decisions on all matters that are financially, operationally or fundamentally significant to the Group. Charter of the Board can be found at: http://www.ssh.com/about/board-of-directors

The Board appoints and dismisses CEO, supervises his or her actions, and decides on his or her remuneration and other terms and conditions of service. The Board also approves the Group's strategy, operating principles and guiding values, and ensures that they are up to-date and correctly implemented. The Board also ensures that the Group has a functional system of internal controls and that the Group's risk management principles have been defined. It also ensures that key business risks have been identified and are being systematically monitored. The Board approves the operational guidelines and annual plan for the internal audit and assesses its effectiveness. Board´s duties and responsibilities are described in more detail in Charter of the Board.

SSH Board of Directors convened 19 times in 2017. Four meetings were held before AGM 2017 (Ylönen, Syrjälä, Manner, Olkkonen and Koponen) and 15 meetings after AGM 2017 (Ylönen, Syrjälä, Manner, Kuivala and Vänttinen). The attendance rate of Board members was: Manner 100%, Syrjälä 95%, Ylönen 95%, Vänttinen 93%, Kuivala 100%, Olkkonen 100% and Koponen 75%.

The Board evaluates its operations and processes to increase efficiency and quality. An internal selfevaluation is conducted once a year.

Due to the relatively small size of the company and number of Board Members currently, SSH has no separate Committees of the Board.

BOARD OF DIRECTORS – MEMBERS

At the Annual General Meeting held on 29 March 2017, Tatu Ylönen, Jukka Manner, Timo Syrjälä, Petri Kuivala (new member) and Ari Vänttinen (new member) were elected as directors of the company's Board of Directors. At the organizing meeting of the Board of Directors, Jukka Manner was elected as the Chairman of the Board of Directors. Manner, Syrjälä and Kuivanen are deemed to be independent board members. The company's CFO acts as secretary to the Board.

Due to the election of the Board of Directors as described in above, both genders are not represented. This is a departure from Recommendation 8 and will be considered in the preparation of the proposal for the composition of the Board to be given to the Annual General Meeting 2018, so that the diversity of the next Board can be ensured.

After the appointment of board member Kaisa Olkkonen as new CEO in December 2016, majority of the Board members were considered as non-independent of the company which was a temporary exception to Recommendation 10 of the Corporate Governance Code. In the current Board of Directors, elected as described above, majority of the Board members are considered independent of the company.

Board Members:

Jukka Manner, born 1972, Ph.D. (Computer Science) Chairman of the Board

Jukka Manner is Professor of Networking Technology at Aalto University. He has more than 20 years of experience in networking, software engineering, distributed systems and cyber security. He has contributed to standardization of Internet technologies in the Internet Engineering Task Force (IETF) since 1999.

Jukka has been principal investigator and project manager for over 25 national and international research projects and has authored over 100 publications, including eleven IETF standards. Prior to joining the board of SSH Communications Security, he served on the board of Stonesoft. He has received the Cross of Merit, Signals, and the Medal for Military Merits for contributions in national defense and C4.

Jukka is also a member of the board of the Nokia Foundation.

Jukka owns 12.000 SSH shares.

Timo Syrjälä, born 1958, M.Sc. (Economics) Board Member

Timo Syrjälä has more than 30 years of experience in capital markets and has spent the last 10 years as a private investor and a non-executive director in several firms. Prior to joining the Board of SSH Communications Security, he served on the Boards of several leading technology firms including Stonesoft and Efore.

Earlier in his career, Timo held executive and managerial positions in management consulting, asset management, and investment banking.

Timo owns 3.559.131 shares or nominee reg. shares (holdings of interest parties included).

Tatu Ylönen, born 1968, Lic.Sc (Tech) Board member, Founder and Major shareholder

When Tatu Ylönen was a researcher at Helsinki University of Technology, the University's data network was compromised by a password attack. Tatu started to develop a solution to prevent similar attacks, and as a result of the work, Secure Shell (SSH) technology was invented and it quickly displaced vulnerable rlog, TELNET and rsh-protocols as a standard solution for data and communication security. Tatu has been an important actor in the rise of the cyber security technologies such as SSH and SFTP. He is also a co-author of the IETF-standard.

Since founding of SSH Communications Security in 1995, Tatu has held various roles in the company, including CEO, COO and Board Member. He is also the largest shareholder of the company.

Tatu holds a degree of Licentiate of Technology from the Helsinki University of Technology (now Aalto University) in Finland.

Tatu owns 18.317.123 SSH shares (holdings of interest parties included).

Petri Kuivala, born 1970, LL.M. Board Member

Petri Kuivala is an experienced international leader who currently works as a Chief Information Security Officer of NXP Semiconductors, which is a world leading provider of security and automotive semiconductor solutions. Prior to NXP he was member of Microsoft Global Security management team and prior to that worked almost 14-years with different Security leadership positions at Nokia Corporation, including as CISO and CSO. Prior to joining Nokia, Petri worked for the Helsinki Police department, and was a founding member of the Helsinki Criminal Police IT investigations department.

Petri does not own any SSH shares or stock options.

Ari Vänttinen, born 1969, M.Sc. (Economics) Board Member

Ari Vänttinen is an experienced leader in international B2B marketing within the software industry and digital economy. Since 2010 he has been an instrumental part of changing the marketing in two Finnish publicly listed software companies (Stonesoft and Comptel) that have both, during his time, increased shareholder value and company valuation significantly. He has deep subject matter expertise in cyber security matters and understands well how to build a global thought leader position in the industry. He has held various marketing executive and management roles and is currently working also as a mentor and advisor for several startups, tech/software companies and their CMOs.

Ari does not own any SSH shares or stock options.

CEO AND EXECUTIVE MANAGEMENT TEAM

The SSH Board of Directors appoints the CEO and decides the terms of his or her service contract. The CEO oversees the company's operative management in accordance with the Finnish Companies Act and the instructions and authority provided by the Board of Directors. The CEO is responsible for the day-to-day management of the company and business planning. The Company's CEO during 2017 was Kaisa Olkkonen.

The CEO's retirement age and determination of pension comply with standard rules under the Employees' Pension Act. The period of notice for the CEO is three months, with 3 months' severance payment. CEO and Board of Directors agrees on CEO´s annual bonus scheme.

The Executive Management Team supports the CEO in managing and developing SSH Communications Security Group, and the members of the Executive Management Team report to the CEO. The Executive Management Team meets regularly, and the CEO chairs the meetings. All issues addressed in the meetings and related decisions are recorded in the meeting minutes.

Executive Management Team Members (31 December 2017):

Kaisa Olkkonen, born 1964, LL.M. CEO as of 1 January 2017

Kaisa Olkkonen is an experienced leader and expert in international business, legal matters, intellectual property, and digitalization. She has previously been, e.g., VP, Legal and VP, Government Relations at Nokia Corporation.

Kaisa has led international and diverse expert teams through changes and transitions. Her international career has taken her on expatriate assignments in Sweden, Singapore, and Belgium.

She also holds Board of Directors positions in Cargotec Oyj, Enfo Oyj, and John Nurminen Foundation, and acts as an investor and advisor in several startup companies.

Kaisa owns 10,000 SSH shares and has 300,000 option rights.

Tatu Ylönen, born 1968, Lic.Sc (Tech) Founder & SSH Fellow, CEO from 17 February until 31 December 2016

For more info on Tatu, please see above under "BOARD OF DIRECTORS – MEMBERS"

Helena Kukkonen, born 1972, M.Sc. (Economics), resigned in December 2017 Chief Financial Officer

Helena brings more than 20 years of experience in financial and management accounting and reporting, finance process, and systems development. She is responsible for financial management, treasury, human resources, corporate development, and corporate governance. She also acts as a secretary to the Board of Directors.

Prior to joining the company in September 2016, Helena held several senior financial management positions at Microsoft Corporation and Nokia Corporation. She headed finance and control functions on group and business unit level for a global large-scale company, as well as global functional finance teams in manufacturing and supply chain area, including mobile phone factories worldwide.

Helena does not own any SSH shares but has 115.000 option rights.

Jussi Mononen, born 1964, M.Sc. (Engineering) Vice President, Business Development

Jussi is a seasoned growth company executive who has been CEO and founder of several venturebacked companies. He has nearly 30 years of management and consulting experience from international technology-intensive businesses with a sound understanding of strategy, communications, marketing, operations, processes, and critical success factors. He also has a strong track record in fundraising and M&A transactions. Previously Jussi was the Chief Operating Officer at SSH.

Jussi does not own any SSH shares but has 100.000 option rights.

Rami Raulas, born 1961, M.Sc. (Economics) Vice President of Sales, EMEA and APAC

Rami is a seasoned Sales Leader with several international leadership positions in Sales & Business Management, Marketing and Product Management in global companies.

He has been developing and leading regional and global sales teams in multiple companies for successful sales growth and customer satisfaction and loyalty.

He is experienced in go to market strategies and implementations and channel partner management. Rami has been working in management positions in Finnish, Asian and Global companies including Nokia, ICL, Fujitsu, Fujitsu-Siemens, Ahlstrom.

Rami holds a Master of Science degree in strategic marketing, business economics and computer science from Helsinki School of Economics (Aalto University).

Rami does not own any SSH shares but has 35.000 option rights.

Markku Rossi, born 1970, M.Sc (Computer Science) Chief Technology Officer

Throughout his close to 25 years of software engineering and software architecture career, Markku has led development teams and architecture design work in several companies. Along with prior SSH experience, he brings his vast background in software, security protocol and database technologies to the company's service.

Markku does not own any SSH shares but has 140.000 option rights.

Jussi Löppönen, born 1963, M.Sc. (Engineering)

Head of PrivX Business Program and Product Management, starting from 31 July 2017

Jussi has extensive experience in international business management. His career includes a long tenure with Nokia where he led two businesses from the beginning to world #1 positions in their segments.

Jussi combines deep market and customer understanding with knowledge of the technology. He also has a very deep understanding of SSH as a company and its products due to his years long career with the SSH R&D team.

Jussi does not own any SSH shares but has 35,000 option rights.

Joe Scaff, born 1981, B.Sc. (Computer Science)

Vice President, USA Operations and Global Customer Services, starting from 13 December 2017

Joe has over 15 years of experience in information security technology and network communications industry. Joe has held various management roles at SSH Communication Security including Technical Sales, Technical Support, and Professional Services.

He has a strong technical and managerial background that allows him to deliver strategic solutions to Fortune 500 customers. He is responsible for all US business operations including America's sales and global customer services.

Joe owns 40,000 SSH shares and has 20,000 option rights.

Simo Karkkulainen, born 1981, QBA (Marketing Management) Chief Digital Officer, starting from 24 November 2017

Simo Karkkulainen brings SSH marketing function over 20 years of experience and a strong international point of view. He is responsible for Global Digital marketing, go-to-market strategies and online demand generation.

Prior to joining the company in December 2017, Simo held several senior marketing positions at Stonesoft, McAfee, Comptel and several other companies.

Simo neither owns any SSH shares nor has any option rights.

The following people also served in the executive management team during 2017:

  • Chris Riley, President, SSH, Inc. and VP, US Sales & Global Marketing, Jan-Dec/2017
  • Kalle Jääskeläinen, Vice President, Platform Management, Jan-May/2017

The CFO of SSH Communications Security, Helena Kukkonen resigned in December 2017 to pursue new challenges outside SSH. Helena Kukkonen will continue in her duties until March 2018. New CFO and a member of Executive Management Team, Niklas Nordström, starts on March 19, 2018.

As announced, Tatu Ylönen, steps down from the Executive Management Team and becomes a Strategic Advisor to the company, effective March 1, 2018.

REMUNERATION AND INCENTIVE PLANS

The annual shareholders' meeting confirms the remuneration payable to the members of the Board of Directors. The Board of Directors confirms the salary and other benefits of the CEO and determines the salaries and benefits payable to senior management.

Forms of remuneration for SSH Communications Security's senior management and CEO involve a performance-related bonus. The company has no other remuneration practices, nor does it have any differing pension arrangements for the CEO or other senior management. The targets for the company's senior management are fixed for the target period at a time.

No new stock option plans were issued in 2017.

Remunerations to the Board of Directors during 2017:

  • Jukka Manner 28.500 EUR (chairman)
  • Timo Syrjälä 19.500 EUR

  • Tatu Ylönen 19.500 EUR

  • Ari Vänttinen 15.000 EUR (new member)
  • Petri Kuivala 15.000 EUR (new member)
  • Kaisa Olkkonen 4.500 EUR (member until 29 March 2017)
  • Harri Koponen 4.500 EUR (member until 29 March 2017)

The CEO's (Kaisa Olkkonen) salary and other benefits in 2017 were in total EUR 259.866,00 (including received remuneration as Board member described above).

The number of shares and stock options held by the members of the Board of Directors, CEO and members of the Executive Management Team are included in their personal profiles above.

The executive management team members' salary and other benefits in 2017 were in total EUR 1.479.812.

INSIDER MANAGEMENT

SSH strictly follows the legislation applying to the management of insiders, including the Market Abuse Regulation (EU) as well as the Guidelines for Insiders approved by NASDAQ Helsinki, and the stipulations and guidelines of the FSA.

SSH's permanent insiders comprise the statutory insiders, namely the Board of Directors, CEO and the Principal Auditor. In addition to these, members of the Executive Management Team are also permanent insiders with a duty to disclose their ownership in SSH. The share ownership of all insiders' subject to disclosure requirements has been made public.

When significant projects are at the preparation stage, the company also draws up insider registers for the projects concerned. Insiders are given written notification of their status as insiders and instructions on the obligations that apply to insiders.

HR department maintains the insider registers, which is responsible for updating the information.

SILENT PERIOD

SSH Communications Security follows a silent period starting 30 days before the publication of its financial reports, during which company refrains from contact with representatives of the capital markets and financial media.

Silent periods during the financial year 2018:

  • 30.12.17-7.2.2018
  • 19.3.-19.4.2018
  • 17.6.-17.7.2018
  • 23.9.-23.10.2018

Insiders are not allowed to trade in securities issued by the company during silent period prior to the announcement of an interim report and the financial statement bulletin (closed window) and 6 hours after the announcement of the results.

INTERNAL CONTROL

Internal control seeks to ensure that the Group's operations are efficient and profitable, that reporting is reliable, and that the Group's operating principles and applicable legislation and regulations are observed.

The Board of Directors is responsible for ensuring that the Group's internal controls and risk management are adequate and appropriately organized for the company's business operations. The Board supervises the CEO to ensure that he or she handles the company's business operations and administration in accordance with the guidelines and instructions issued by the Board of Directors. To ensure adequate risk management, the Board of Directors discusses the Group's business and financial reports, as well as any substantial changes that have occurred in the company's business. The Board also assesses the adequacy and appropriateness of internal controls and risk management.

The CEO is responsible for the practical organization of internal controls. Among other duties, he or she ensures that the company's accounting practices comply with the law and is handled in a reliable manner. The Group's directors and managers are responsible for internal controls within their own areas of responsibility.

The Board is responsible for ensuring that the Group has defined guidelines and practices on internal control and that the internal controlling is effective and monitored. The Board holds the main responsibility in accounting and financial management. The Board also confirms the risk management and reporting procedures, and supervises the adequacy, appropriateness and efficiency of the company's management processes.

The CEO, assisted by other executive management, is responsible for the organization of accounting, administration and control mechanisms, and ensures that laws and regulations, company policies and board decisions are followed. Internal rules and guidelines have been published to support the company's operations. It is also ensured that there is a process description of all key processes and that the different process interfaces are clearly defined and described. The purpose of defining the processes is to ensure that everyone in the organization knows how the company operates and how each employee´s work links into the company's overall activities. Supervision and monitoring measures ensure compliance with rules, instructions and processes.

The company sets financial targets annually for budgeting, and continuously monitors their implementation and fulfilment of these targets. The company's organizational structure supports effective business planning, implementation and control.

RELATED PARTY TRANSACTIONS

Company evaluates and monitors transactions concluded between the company and its related parties to ensure that any conflicts of interest are taken into account appropriately in the decision-making process. The company keeps a list of parties that are related to the company. Regardinbg the related party transactions, the company also takes into account the general principles of the Limited Liability Companies Act, such as the purpose of generating profit for shareholders, the principle of equity of shareholders and the diligence obligation of the management.

All material decisions related to any agreements with related parties or any other related party transactions are made by the Board of Directors. Decision-making procedure for related party transactions is based on careful preparatory work and appropriate reports, opinions and assessments taking into account all relevant disqualification provisions under the applicable laws and corporate governance rules. Related party transactions are identified, reported, and controlled by the impartial board members and CFO, who monitors and reports the company's related party transactions in accordance with the company's reporting practices.

Related party will not participate in making decisions related to any agreement between him/her and the company, or related to any matter that concerns an agreement between the company and a third party, where the related party is likely to have an essential interest in the matter.

RISK MANAGEMENT

Risk management aims to ensure that company´s strategic and operational targets are reached and operations safeguarded.

Risk management principles:

Risk management is based on the risk management policy approved by the Board of Directors. We define a risk as an external or internal uncertainty factor that, if realised, would either positively or negatively affect our potential to achieve our strategic and financial targets. We seek to forecast, identify, evaluate and control significant strategic, operative, financial and accident risks. The Board of Directors defines the Group's risk appetite and risk tolerance through its decisions and monitors the sufficiency and effectiveness of the Group's risk management.

Responsibilities:

The CEO is responsible for the implementation of risk management. The CFO holds primarily responsibility for managing financial risks and coordinates the implementation of risk management processes, and reports risks to the CEO, the Executive Management Team and the Board of Directors. The Executive Management Team members are responsible for executing the risk management policy in their own areas. General Counsel is responsible for contractual and legal risk management and reports risks to the CEO and CFO. Every employee is responsible for identifying any risks relating to their own work and bringing them to the attention of their supervisor.

SSH Communications Security´s largest risks and uncertainties:

The largest risks that might impact the profitability of the company are listed below. Other risks, which are currently either unknown or considered immaterial to the company may, however, become material in the future.

Largest risks:

  • uncertainty of the macroeconomic environment
  • cybercrime, including e.g. ransomware
  • delays in product development and closing new business
  • ability to execute our strategy
  • ability to retain and recruit key personnel
  • maintaining our ability to innovate and develop our product portfolio including intellectual property rights (IPR)
  • IPR litigation and the utilization of our patent portfolio
  • large portion of the company revenue is invoiced in USD currency so possible large fluctuation in USD currency rates during 2018 could have unpredictable effects for profitability that are at the time difficult to estimate. The company decides on hedging of USD based contracts case by case.

Principles and organization of risk management of SSH Communications Security can be read from company´s webpage: www.ssh.com.

INTERNAL AUDITING

Because of the relatively small size of the company, SSH Communications Security has no separate internal audit organization. The continuous monitoring by the auditors in conjunction with the interim reports also aims to assess and develop the effectiveness of risk management, monitoring and administration processes, and to support the Board with its monitoring responsibility.

AUDITORS

SSH Communications Security has one auditor, which must be a firm of authorized public accountants approved by Finland's Central Chamber of Commerce. The Annual General Meeting elects the auditor for a term of office that runs until the end of the following Annual General Meeting.

The scope of the audit encompasses the Group's accounting, administration, Financial Statements and Board of Directors' Report for each accounting period. The Auditor makes regular reports to the Board of Directors and submits an Auditors' Report to the Annual General Meeting. The Auditors' Report contains a statement as to whether the Financial Statements and the Board of Directors' Report give a true and fair view, as defined in the rules governing financial reporting, of the Group's operative result and financial position, and as to whether the information contained in the Board of Directors' Report is consistent with the Financial Statements. The auditor's fee is paid annually on the basis of an invoice, in accordance with the Annual General Meeting's decision.

SSH Communications Security's auditor is Ernst & Young Oy with Erkka Talvinko as principal auditor.

In 2017, the auditor's fees were:

Principal Auditor (Ernst & Young)

  • Regulatory auditing EUR 36.000
  • Other auditing EUR 12.900
  • Tax consultancy EUR 800
  • Other services EUR 5.131

Other auditors:

  • Regulatory auditing EUR 17.779
  • Other auditing EUR 4.109
  • Tax consultancy EUR 19.113
  • Other services EUR 685

DISCLOSURE POLICY

SSH Communications Security Group's parent company, SSH Communications Security Corporation, is domiciled in Helsinki, Finland, and its share is listed on NASDAQ Helsinki. In its communications SSH Communications Security observes Finnish and EU legislation, the rules of Nasdaq Helsinki, the regulations of the Finnish Financial Supervisory Authority, as well as the principles set out in the Company's Corporate Governance Statement. SSH Communications Security's communications are based on facts and objectivity, and guided by the general principles of trustworthiness, openness and timeliness. SSH aims to provide the market with a clear and comprehensive picture of the company's operations and financial condition in accordance with the notification obligation of a listed company. The company favours communications in electronic form. All company stock exchange releases, other investor information on the company, and other latest information are available on the company's website. SSH Board of Directors approves the Disclosure Policy, which is revised when necessary.

BUSINESS ETHICS AND RESPONSIBILITY

SSH operates in a socially and ethically responsible manner, respects the environment and society, promotes the internationally proclaimed human rights and ensures ethical business practises at all times.

SSH has set out a clear Anti-Bribery & Anti-Corruption Policy which prohibits all forms of bribery and corruption. The policy is communicated to all employees in a new employee training. Any allegations of bribery or corruption will be investigated thoroughly. The Anti-Bribery & Anti-Corruption Policy is available at www.ssh.com. SSH has also established a whistle-blower process which is initiated when someone reports suspected internal or external misconduct or violation of law, regulations, human rights, labour practises or similar within the operations of SSH Group or by its personnel.

SSH respects the surrounding environment and aims to make sure that all of its offices are green and energy-efficient, and that environmental impacts are maintained as low as possible. Most of the

environmental impact comes from energy consumption of the offices, which is minimised by reusing supplies and recycling. Travel emissions from employee commuting and business travelling are minimised by supporting remote working and online conferencing options.

All employees of SSH have right to safe and healthy working environment where personal well-being is promoted, and any form of discrimination or harassment is prohibited. Every employee is treated with equal consideration and fairness. All decisions concerning employment are determined by the employee's performance, not on any discriminatory grounds, such as gender, age, nationality, ethnicity, religion, political affiliation, disability or sexual orientation. In 2017, all full-time employees had individual development discussions and were part of the performance management program.

SSH considers diversity as a strength and actively encourages diversity throughout the organization, including top management and the Board of Directors. The principles on diversity are always taken into account when considering nominations to the Board of Directors. SSH aims to have board members representing both genders, as well as different professional and educational backgrounds.

At the end of 2017, the personnel of SSH consisted of 80 employees in total. 17.5% of the personnel were women and 82.5% were men. The average age of the employees was 40.8 years. 13.8% of the employees were under 30 years, 31.2% between 30-40 years, 32.5% between 40-50 years, and 22.5% over 50 years. 47.5% of the employees had been working for SSH less than 2 years, 28.8% for 2-5 years, 11.2% for 5-10 years, and 12.5% for over 10 years.

Talk to a Data Expert

Have a question? We'll get back to you promptly.