01.01.2024-31.12.2024
Kestävyysraportti 2024
Report approved by: Hallitus, 14.05.2025
Excellent results in an international sustainability assessment - determined leaps towards a carbon-neutral company. We have continued our work to promote Loiste's sustainability and last year received excellent results in the international infrastructure sector Global Real Estate Sustainability Benchmark (GRESB). Our overall result (98/100) is clearly above the average (88/100) of other companies that participated in the evaluation. We received five out of five stars in the comparison and ranked second in our own comparison group. The GRESB assessment annually measures the operations and success of companies in several different areas in environmental matters, social responsibility and good governance, i.e. the so-called ESG matters (Environment, Social (people) and Governance). Sustainability is at the center of all our activities. It means that all our business operations look for and implement business-wise the solutions and investments that best promote sustainable development and our responsibility. Loiste Group's board of directors has outlined and approved a sustainable development strategy in 2022. The strategy defines the target state and the methods of engaging the community in ESG principles. By committing to ESG standards and principles, our company publicly demonstrates its commitment to ESG and zero emissions. In this work, we use the standards of the organization's processes and the frameworks required by the EU Directives, which are generally accepted, and which impose obligations on us to comply with the regulations. Our commitment is described in this responsibility report. We work purposefully to reduce emissions and promote the green transition. Our goal is to increase the production and use of renewable energy and to end the use of fossil fuels. Loiste is renewing its district heating production capacity. The project will be based as much as possible on the waste heat and electric boilers of the data centers located in Kajaani - the production equipment will therefore be based on emission-free and energy-efficient technology. Business Finland granted about 5.4 million euros in EU support. In the production of district heat, we are moving to a so-called hybrid model, which utilizes new technologies in a versatile way. Our goal is to make our district heating production completely carbon neutral by 2026. Today, the district heating network covers approximately 70 percent of the area of the central agglomeration of Kajaani. Our work to improve the supply security of the electricity grid and to connect the increasing local electricity production to the grid also continued last year. 45.6 megawatts (MW) of new wind power was connected to our electricity grid. There are currently five wind farms connected or about to be connected to the network, with a total power of about 500 MW. The construction of small solar power plants also continued strongly. 271 new small power plants were connected to the grid. Electricity grid loss is emission-free energy from the beginning of 2024. As a responsible employer, we promote an open and caring work culture. For continuous work to improve the working community, we have received 88% in the Great Place to Work™ certification. This year, Loiste was selected among the 50 best companies in Finland. This means that Loiste is a really good place to work as a whole - the corresponding figure is an average of 39 percent in Finnish companies. We have been certified since 2013. The recognition came now for the fourth time, and the result was the best so far. Lasse Aarnio, CEO, Loiste companies Standards and regulations considered in the report The sustainability report for the financial year 2024 has been prepared in accordance with the international IFRS S1 (General Requirements for Disclosure of Sustainability-related Financial Information) and IFRS S2 (Climate-related Disclosures) standards, the European Union’s Corporate Sustainability Reporting Directive (CSRD), the requirements of the European Sustainability Reporting Standards (ESRS), and the EU Taxonomy’s technical screening criteria.
Description of the organization’s operations The sustainable development responsibility program has been prepared to cover the entire group. Regarding EU Taxonomy alignment: Loiste Energia Oy, Loiste Lämpö Oy, Kajave Oy, Otanmäen Lämpö Oy, and Loiste Liittymisjohdot Oy.Our operations are 96% EU taxonomy-aligned in terms of revenue, 100% in CAPEX, and 91% in OPEX. This is influenced by the share of Kainuun Voima, which is neither taxonomy-eligible nor taxonomy-aligned (4%). In the short term (1–2 years), there will be no changes in the business as a whole. In the medium term (2–4 years), the business environment will remain largely unchanged, but district heating production will become almost emission-free and fully taxonomy-eligible. In the long term (over 4 years), we require 100% taxonomy-eligibility and full compliance with sustainable development across the entire value chain involved in our operations.The scope of consolidation is the same as in the financial statements and includes all subsidiaries.The sustainability assessment covers the company’s upstream and downstream value chain as follows (ESRS BP-1):• Upstream: contractors, supply chain workers, suppliers, and energy production plants• Downstream: customers, residents, the community, owners, financiers, society, our own employees, and other stakeholders we impactIn Loiste's operations covering the entire value chain, there are no risks related to child labor, and this is therefore considered immaterial. The operations of the Loiste companies take place in Finland and are subject to national supervision, internal monitoring by Loiste, and supplier assessments. The supply chain includes international operators, from whom we require compliance with ILO, OECD, UN human rights, and other international standards and guidelines. We conduct supplier assessments regularly.Key focus is placed on monitoring environmental, social, and governance aspects of contractors, the supply chain, suppliers, and production facilities. We conduct audits of these chain actors and monitor legal compliance through official reports. Workplace safety in particular is under continuous monitoring, and other areas are audited annually.We do not report classified or sensitive information in the public sustainability report, nor do we disclose material involving industrial property rights, trade secrets, or results of innovation activities. We also do not publish information on ongoing development initiatives with strategic business impact or information not yet available for publication due to supplier cooperation.Reporting timeframesWe follow the following reporting timeframes:a) Short term: the same period as the financial reporting period;b) Medium term: up to 5 years; andc) Long term: over 5 years.In addition, we may refer to specific risk-related timeframes:-1–30 days-1–11 months-1–5 years-5–20 years-over 20 yearsThere is no measurement uncertainty related to quantitative indicators and financial estimates within the value chain.Company operationsWe renew and secure the energy infrastructure of Kainuu and surrounding areas and contribute to achieving regional carbon neutrality goals. We operate regionally under official oversight. We do not use banned products or operate in prohibited markets. Our actions focus on improving our own operations, ensuring the responsibility of our value chain (subcontractors, partners, and customers), and our products and services. Our responsible operations include evaluating and considering the direct and indirect impacts of the company on the environment, people, and society during the annual strategic review. We implement due diligence through measurement, value chain assessments, and reporting (GOV-4). Our operational policies, targets, and indicators, as well as procurement and supplier policies, detail the key actions taken and planned for the future, their expected results, and where applicable, how their implementation supports achieving the objectives of our operating principles. These actions cover all business operations and stages of the value chain in the Kainuu area. Our sustainable development strategy includes the scope and volume of necessary investments (MDR-A).The company’s financial, legal, and operational status is assessed systematically and comprehensively as part of the strategic planning update and the regular monitoring of operational activities (due diligence, GOV-4, AR8-10). The organization of these assessments, monitoring of effectiveness, and communication are as follows:- Responsibility for assessment: business processes- Audit: group management team- Reporting: group board of directors- Monitoring of goals: committees reporting to the management team and board- Stakeholder communication: via the group management team or business unitsDescription of the business model and value chain used to implement the strategy (SBM-1)1. Inputs and approach: gathering information, developing and securing operations:a. Market analysis as a basis for strategyb. National and EU legislation: current and upcomingc. Identifying business value chains and stakeholder analysisd. Additional information found in:• Other management systems and scope• Scope and coverage of the responsibility program• Description of company operations• Sustainable development strategy• Vision• Mission2. Outputs and outcomes: current and expected benefits for customers, investors, and other stakeholders:a. Updated stakeholder descriptionsb. Stakeholder expectations and strategic alignmentc. Impacts of legislation and EU directivesd. Additional information found in:• Stakeholders and their needs and expectations• Scope and coverage of the responsibility program• Sustainable development strategy3. Main features of the upstream and downstream parts of the production chain and the company’s role in its value chain, including key actors (e.g., main suppliers, customers, distribution channels, end users) and their relationship to the company. If multiple value chains exist, disclosures must cover the key ones.a. Additional information found in:• Description of company operations• Stakeholders and their needs and expectations• Procurement policy• Sustainable development strategyCustomersElectricity transmission business:- Transmission is a monopoly, and all residential and business customers in our area with a valid electricity transmission contract are customers.District heating business:- The sector is competitive, and customers include both consumers and businesses with valid district heating contracts.- District heating products and services support all Kainuu region customers in achieving sustainability goals. Primarily carbon-neutral heat will be available during 2026.Electricity production business:- Electricity produced is sold on the NordPool electricity exchange.Loiste Liittymisjohdot Oy:- Customers may include wind farms, solar farms, and large industrial facilities requiring high-power connection lines.Value chain assessment is conducted annually before supplier evaluation. Significant suppliers are identified and evaluated via electronic or oral assessments on sustainable development topics. The questionnaire follows the content of the Procurement and Supplier Policy. Uncertainty in the value chain relates to those actors who do not receive the questionnaire, and the impact is deemed small or very small based on the materiality analysis. Regarding upstream emissions in the value chain, there is uncertainty about how reliably verifications have been obtained and how ready the actors are to provide emissions data, especially when it concerns Loiste (BP-2).The responsibility program describes the basic principles of our operations and the environmental, social, and societal impacts of our activities (ESG: Environment, Social, and Governance) and how we promote the sustainable development impact of our stakeholders on our own operations.The responsibility program includes limited disclosure of information in accordance with ESRS 1 7.7 that relates to intellectual property, know-how, innovation outcomes, classified information, or sensitive information.
As a responsible energy infrastructure company, we are present in the everyday lives of Kainuu residents and enable the region’s development.
We are a responsible renewer of energy infrastructure. We focus on maintaining and developing energy infrastructure in Kainuu and surrounding areas. We ensure the development and distribution of carbon-neutral district heating for customers in our service area. We are involved in building renewable energy production in our region. We are committed to supporting Finland’s goal of becoming carbon neutral by 2035 and aim to achieve carbon neutrality in our own operations by 2026.We contribute to a low-carbon and resource-efficient society by promoting the adoption of renewable and innovative energy production and storage solutions.We produce emission-free electricity at hydropower plants under our management. We maintain and develop our electricity network to meet the needs of today and tomorrow, taking local conditions into account.We enable our customers to access as carbon-neutral district heating as possible by investing in renewable energy sources. We collaborate with various stakeholders and actively support the transition towards environmentally friendly and renewable energy production.We maintain and develop our electricity network to meet current and future needs and local conditions. We enhance the reliability and capacity of the electricity network to meet the demands of an increasingly electricity-dependent society. We enable our customers’ green transition by developing the electricity network in response to evolving needs.
JoyfulnessEffectiveness- We set reasonable goals to achieve our strategy. We work together and individually to deliver results. - We are proactive and committed to effective action.Customer Orientation- We act ethically and responsibly, respecting other people and the environment. We contribute to building vitality. - We are proud of our roots. - We never compromise on safety. - We listen to our customers and continuously improve our operations based on their needs.Courage- We boldly take action and always strive for better solutions. - We have the courage to pursue innovative solutions or investments, tolerate uncertainty, and learn from mistakes.Trust- We mean what we say and keep our promises. Trust is at the core of our human-centered culture. - We act transparently and communicate clearly. We are open to the ideas of others and encourage sharing them. - We respect and value one another. At Loiste, everyone is seen and heard as their true selves.
Sustainability Program Management System GOV-5 (Responsibility: Board of Directors)Clarification, monitoring, analysis, and evaluation: Business units Review: Management team Reporting: Group Board of Directors Prepared: 2022 Reviewed: 2024The management system included in the sustainability program (ISO 9001:2015, ISO 14001:2015, ISO 45001:2018, ETJ+) covers all business operations and support processes of the Loiste companies. It supports the implementation of the company's goals, values, and strategy. The goal of the sustainability program is to measure and monitor transparency, good governance, and the consideration of people and the environment in accordance with applicable rules. The operational policy is part of the sustainability program.The company's Board of Directors has established and approved the guiding policies for sustainable development, the code of ethics, other policies, and the board's rules of procedure. These policies and guidelines complement relevant legislation, the shareholder agreement, articles of association, and the City of Kajaani's group instructions and ownership policy. The board monitors the implementation of the principles set in the policies. Our strategy defines our commitment to systematic and continuous development. The aim of Loiste’s management system is to ensure the safe, sustainable, reliable, and cost-effective management of operations, products, and services, considering their full life cycle and the functionality of its own, partner, and customer processes.The policies are reviewed regularly and updated as needed to reflect operational practices and current standards. They apply to the entire Group. Practices are monitored in business unit meetings. The implementation of the policies and the management of the system are audited internally and externally at least annually.Policies of Loiste Group:• Sustainability Program Operational Policy • Risk Policy • Procurement Policy (including supplier management) • Corporate Governance and Control SystemWe operate with attention to stakeholder needs, expectations, and the value of collaboration. Our operating models are described in processes that include monitoring and measurement of our sustainability performance, meeting the requirements of quality systems, ESG frameworks, and the EU taxonomy. Loiste is committed to upholding equality and non-discrimination throughout its operations, in accordance with the UN human rights principles, ILO, and OECD guidelines. We also expect compliance with these standards from our value chain and suppliers in the context of responsible business conduct.• Loiste companies operate responsibly and transparently in all activities. • We assess and review double materiality in accordance with ESRS standards as part of risk management. • We identify stakeholder needs and expectations and integrate them into operations through our processes. Key stakeholders include customers, personnel, suppliers and partners, authorities, financiers, and owners. • We value diversity. • We actively monitor changes in the operating environment. • We consider legal and international agreement perspectives in our work.Environment• Climate change mitigation: We aim to develop our operations in a way that maximizes their positive impact on climate change mitigation. • We promote adaptation to climate change and ensure our infrastructure is protected from its effects as effectively as possible. • We support the sustainable use and protection of water resources and marine natural resources. • We promote the transition to a circular economy. • We prevent environmental degradation. • We protect biodiversity and various ecosystems and aim to restore them. We free up land for forest growth and carbon sinks by relocating power lines along roads and by underground cabling.Social SustainabilityWe aim to be the most attractive workplace in the energy sector, composed of top professionals. At Loiste, well-being and happiness are created through freedom to influence, collaborative action and development, shared values, and the growth and progress we foster. The goal of our personnel strategy is to ensure the expertise needed to meet critical and strategic objectives during times of change, to engage and motivate people, and to provide a framework in which our professionals can continuously develop their skills as the energy sector and our needs evolve. Together, we are building a culture of trust, openness, and collaboration. We encourage experts to take responsibility.• We develop and maintain a company culture that respects aspects such as gender, diversity, working conditions, human rights, and the respect of human rights. • We aim to employ locally and provide training for our staff. • We require good personnel management and maintenance of professional qualifications from our partners. • We comply with ILO, OECD, and UN human rights principles.Social ResponsibilityWe comply with the values of Loiste Group. Loiste has adopted a Code of Ethics that must be followed in all activities. Through our commitment to social responsibility, we contribute to the well-being of society. Responsibility includes statutory elements such as employee social security and occupational healthcare, as well as voluntary investments. Actions that have a positive impact on employees, stakeholders, and society generate financial added value and competitive advantage. Loiste expects its suppliers to ensure good working conditions for employees in the value chain, which we also assess in supplier evaluations.For employees, we consider:• Employment security • Working hours • Sufficient wages • Dialogue between labor market parties • Freedom of association, including works councils • Collective bargaining agreements in place • Work-life balance • Occupational health and safety • Child labor is prohibited • Forced labor is prohibited • Discrimination is prohibited • Indigenous peoples’ rights are respectedLoiste Group’s social responsibility applies not only to its own personnel but also to the personnel of partners, contractors, and subcontractors when they work on our behalf. Responsibility also includes selecting subcontractors who take care of their own employees. We have monitored employee well-being annually since 2003 through a staff barometer survey. Since 2016, the employee survey has been conducted using the Great Place To Work method, which allows us to address potential work-related challenges at an early stage. In addition, we regularly conduct an anonymous "Mood Survey" where employees can submit open feedback or questions to management, which are addressed in staff briefings. Constructive development discussions with supervisors and opportunities for confidential feedback are considered important. We strongly support staff’s voluntary education.Our personnel are our most important asset and resource, and we encourage and support them to:- actively participate in planning and developing our operations - learn to manage continuous change - develop professionally - seek meaningful and challenging work - maintain their physical and mental well-beingOur goal is to be a united team whose members can work together flexibly and are willing to solve workplace challenges boldly and constructively. Our actions are guided by self-initiative and open-mindedness.Equality and Non-Discrimination ProgramLoiste is committed to promoting equality and non-discrimination in all its operations. Our goal is to be an innovative and developing work community where every employee is accepted as they are. Equality is promoted through an inclusive approach involving the entire staff. Loiste Group has an Equality and Non-Discrimination Program, which guides our operations.Equality must be promoted systematically and with clear goals, creating conditions that do not prevent the realization of equality. The planning must identify solutions that increase gender equality. The aim of promoting equality and implementing related measures is to ensure that procedures in areas such as recruitment, task allocation, training, remuneration, employment benefits, and obligations related to work and employment relationships are genuinely non-discriminatory. This means practical efforts to promote equality.We value individual freedom and beliefs. We respect each other equally regardless of age, gender, organizational position, or other personal characteristics. We actively provide feedback and develop various forms of recognition. We recognize and reward individual employees for significant work achievements.Our company has a formal Equality and Non-Discrimination Program. Equality is promoted through inclusive practices involving all personnel and coordinated by the company's occupational health and safety (OHS) team.Occupational Health and SafetyOccupational health refers to physical and mental work capacity and health. The goal of OHS activities is to maintain employee health and prevent hazards and harm caused by work and working conditions.Occupational safety means that the physical, mental, and social working conditions at the workplace are in order. When employees have a safe environment, a functional work community, and work that is appropriately demanding, their work is meaningful and productive.Occupational safety is a cooperative effort between the employer and employees to ensure a safe and healthy working environment.Identification of occupational health and safety hazards, monitoring of legislation, and assessment of social risks (Responsibility: HR Manager, Occupational Safety Manager)We promote the health, safety, and well-being of our personnel, as well as proactive and knowledge-based well-being management. Our goal is a zero-accident Loiste. Together with our staff, we ensure a safe, healthy, and productive work environment and smooth working conditions. We support the comprehensive physical, mental, and social well-being of our employees. We take care of our employees' work ability throughout their careers and provide support in various situations.Our activities must not pose health or safety risks to our employees or external individuals. We require the same from our service providers – that they ensure the safety and well-being of their personnel.Occupational health and safety indicators are regularly monitored in various committees and service management meetings. More detailed descriptions are recorded in locations specified in process documentation. Loiste Group complies with relevant legislation, standards, and other applicable regulations. Occupational safety and employee representation activities are organized in accordance with the law.Legislation is monitored through a legal system in accordance with the process and annual schedule, reviewed four times per year. The OHS committee and the HR Manager identify the most significant social and occupational health and safety risks and hazards based on collected information. This data is gathered from various measurements and feedback, as well as through personal discussions and training. For suppliers, data is collected through service management meetings and digital reporting channels. Customers may also contact customer service.Social Aspects Related to Personnel and StakeholdersAs part of the sustainability program, we consider the following social aspects, which are covered by our practices:• Child labor: Child labor is prohibited both in our own operations and those of our suppliers. • Community development: We develop our community in cooperation with stakeholders. • Customer satisfaction: We continuously improve and monitor customer satisfaction. • Diversity, equity, and inclusion: We ensure and require the implementation and adherence to diversity, equity, and inclusion in both our own and our suppliers’ operations. • We follow the International Labour Organization (ILO) rules in our own operations, procurement requirements, and across our value chain. • Employee engagement: We engage employees by enabling their active participation in company development, training opportunities, and providing various employee benefits. • Forced or compulsory labor: Forced labor is prohibited in our own operations and those of our suppliers. • Freedom of association: Everyone has the right to freedom of association, which must also be respected by our stakeholders. • Health and safety – community: We ensure a safe environment for the residents of our community. • Health and safety – contractors: We require compliance with occupational health and safety guidelines. • Health and safety – employees: We require compliance with occupational health and safety guidelines. • Health and safety – supply chain: We require compliance with occupational health and safety guidelines. • Health and safety – users: We ensure a safe environment for the residents of our community. • Labor standards and working conditions: We require a safe working environment, labor standards, and proper guidance. • Local employment: We hire local personnel and, where possible, local businesses. • Societal corporate partnerships: We cooperate closely with other companies whenever possible. • Stakeholder relations: We maintain ongoing dialogue with our stakeholders.Development of Social AspectsBy considering social aspects, we can broadly create services, jobs, and well-being. These topics are addressed through personnel management, leadership, strategy, and partner management. Loiste adheres to an Equality and Non-Discrimination Program and reports monitoring results to authorities annually.The program is based on the Group’s own starting points and meets the legal requirements set for it. The effectiveness of equality is measured using various staff surveys and statistics. Social aspects of suppliers are described in supplier requirements. Specific questions and indicators for suppliers are monitored via service management meetings and an annual digital questionnaire. The questionnaire is aligned with the ESRS standard.Customers and residents can provide information through online forms available on our public website, in addition to direct customer contacts.Personnel PolicyOur personnel policy is based on Loiste’s mission, vision, strategy, values, and responsible operational and leadership principles. A good employee experience is built on the consistent and uncompromising implementation of these principles.Objectives of the Personnel Policy• The objective of the policy is to ensure that competent and committed personnel, who understand Loiste’s direction and their own goals, provide the foundation for achieving strong and sustainable financial results. • Our personnel policy consists of Loiste’s key principles across areas of HR management. • The policy covers all operations within Loiste Group. Business units and teams are responsible for implementation and resourcing within their own functions. • Our operating principles define how all Loiste employees work and collaborate. All our actions are grounded in our four core values: Customer Focus, Together We Achieve More, Joyfulness, and Responsibility.Leadership• No issue is too small to be discussed across teams. Providing feedback and development ideas is important and encouraged. All issues are company issues, and feedback contributes to our development. • The cornerstones of Loiste leadership are strategy-driven management, enabling success, trust, and mutual respect. • Performance management supports the implementation of our strategy and business goals through strong employee performance. Setting personal goals aligned with business targets, monitoring progress, providing regular feedback, and evaluating performance help motivate and engage employees. Employees are responsible for their own performance management, supported by their supervisors. Supervisors conduct regular discussions with each of their team members. Ongoing performance management and dialogue play a critical role in ensuring successful strategy execution.Rewarding• The core principles of our rewarding system are competitive total compensation based on performance and fair treatment of employees. The goal of rewarding is to encourage strong performance and recognize achievements. It ensures the success of the company. Rewarding practices are based on our strategy and business goals and are supported by regular salary reviews, group-wide and business-specific performance bonuses, and common employee benefits.Competence• Our competence development solutions are based on our strategy and business goals, aiming to guide personal learning paths and needs-based learning. Competence development lays the foundation for success at work and employee well-being. • We ensure thorough onboarding of our employees. Employees are responsible for their own competence, and supervisors support the development of their team members’ skills. • Development discussions play a key role in competence development. Supervisors conduct these discussions with employees at least twice a year. In addition, we provide regular feedback on job performance. We develop the competence of our supervisors to ensure high-quality leadership and supervisory work. • When evaluating strategy and success, it is important to consider which work is done in-house and what services or resources are procured externally.Recruitment• We continuously develop our recruitment methods, leadership recruitment skills, and the applicant experience. • In recruitment, we are committed to equality, non-discrimination, and selection based on factors that predict success in the role. In our hiring decisions, we emphasize energy and subject matter expertise, education, and motivation. • We support internal career paths, aiming for diverse and long-term employment relationships that allow employees to grow and develop. • We manage the entire employment lifecycle and succession planning on an ongoing basis. • We develop cooperation with educational institutions to ensure a supply of new talent.Salary and Reward PolicyBoard of Directors: The company's Board of Directors oversees the implementation of the salary and reward policy and makes necessary decisions regarding compensation practices. The incentive system is updated annually and approved by the Group's Board of Directors.1. IntroductionLoiste Group’s salary and reward policy is designed to support the company’s strategic objectives, attract and retain skilled employees, and ensure that compensation practices are fair, competitive, and transparent. The incentive system is updated annually and approved by the Group Board. Achievement of sustainability goals also affects the compensation of governing, managing, and supervisory bodies.2. Salary PrinciplesCompetitiveness: Our salary levels are competitive compared to the industry average. We regularly use market and salary surveys to ensure our pay is up to date. Fairness: Compensation is based on job demands, employee competence, and performance. Job evaluation is based on the Mercer International Position Evaluation (IPE) system. Transparency: Our salary system is clear and open to all employees. Employees are regularly informed about the principles and practices of compensation.3. Reward PrinciplesPerformance-based: Rewards are based on employee performance and achieved goals. Performance evaluations and target achievement metrics form the basis for rewards. Motivation: The reward system aims to motivate employees and promote their commitment to the company. We offer various forms of rewards to meet the needs and expectations of employees. Equity: All employees are treated equitably and without discrimination. Reward practices are consistent and fair for everyone.Loiste’s carbon neutrality is a strategic goal for sustainable development, directed by the CEO and implemented by business management. Employees receive performance-based bonuses based on the company’s financial results and achievement of strategic goals, including sustainability targets. The sustainability strategy aims for Loiste to be carbon neutral in its own operations by 2026 and for emissions from suppliers to be below 10% by 2030. This is measured using the GRESB and CO2 indicators. Bonuses are determined 50% by financial performance and 50% by personal goals, including progress on sustainability actions.Good GovernanceGood governance means that all parties are treated equally and statutory rights are recognized. Owners are encouraged to participate in the company’s activities, and they receive regular and accurate reporting on the organization’s financial situation. In addition, good governance involves the guidance and oversight by the organization’s governing bodies and accountability.Our oversight responsibilities cover the timely and accurate reporting of financial information as well as auditing, internal control, risk management, compliance with laws and regulations, and ensuring that management and governance practices are properly arranged.Business managers are responsible for overseeing impacts, risks, and opportunities. The organization’s group-level management team compiles information and, supported by the ESG Controller, reports to the group’s board of directors. Actions reflecting the impacts, risks, and opportunities are described in the corporate governance model, which outlines the business managers’ authority in relation to subsidiaries. CEOs of the subsidiaries seek investment decisions from the group’s board of directors. Business management is responsible for updating the policies. They are supported by the ESG Controller.The administrative, managerial, and supervisory bodies decide that, in order to monitor sustainability matters, an external specialist will be used to support the group’s ESG Controller. Appropriate skills and expertise are developed through training and internal guidance meetings on sustainability within the group.Representatives of the business units regularly review sustainability issues in supplier service management meetings in accordance with the procurement policy guidelines. Continuous orientation and guidance ensure that these skills and expertise relate to the company’s material impacts, risks, and opportunities.Administration must ensure independence, cybersecurity, data protection, authorizations, remuneration methods, and the identification and prevention of conflicts of interest. Any significant conflicts of interest related to our business are sufficiently examined and acted upon if necessary. We require good governance from our partners as well and promote the realization of good governance throughout our value chain. We reserve sufficient resources and tools to carry out our operations in the manner we desire, as well as to develop our operations and competence.We engage, encourage, and commit our own employees and those of our partners to improve efficiency, occupational safety and well-being, environmental impact, and energy efficiency.In new investments, we adopt the best and most reliable available technical and financial solutions. We guide our customers to act responsibly in decisions affecting safety, the environment, and energy efficiency. We require our partners to commit to our practices and policies. We support the development of our partners’ operations and management, and improve the performance of the entire network from the perspectives of quality, efficiency, safety, environmental impact, and energy efficiency. Our management system meets the requirements of the ISO 9001 quality management system, ISO 14001 environmental management system, ISO 45001 occupational health and safety management system, and the ETJ+ energy efficiency system.Our responsibility program includes the following practices related to governance:• Audit committee structure/independence: Auditors are independent of the company.• Board composition: The Board is elected by the General Meeting, and Board members are not employed by the company. We require Board members to confirm they and their family members have no commitments to the group or its subsidiaries.• Board’s ESG oversight: The Board approves policies and receives reports on the implementation of the strategy.• Bribery and corruption: Bribery is prohibited, and ethical guidelines must be followed.• Remuneration committee structure/independence: The remuneration committee represents different stakeholders, and no committee member may be someone who might receive remuneration.• Conflicts of interest: Conflicts of interest are prohibited and are also addressed in the procurement policy.• Cybersecurity: A designated individual is responsible for data protection and information security for the entire group in accordance with NIS2 rules.• Data protection and privacy: We comply with the legislation.• Delegation of authority: We follow a multi-layered approval process concerning authority.• Management remuneration: The group’s Board of Directors decides on executive remuneration.• Fraud: Fraud is prohibited and criminalized.• Independence of the Chairman of the Board: The Board is elected by the General Meeting, and Board members are not employed by the company. The Chairman is elected by the Board.• Lobbying activities: Lobbying is prohibited, and ethical guidelines must be followed.• Political contributions: Political activities and affiliations are prohibited.• Shareholder rights: Shareholder rights are defined in the agreements.• Whistleblowing protection: Whistleblower protection is in place, and a reporting channel is available.Quality Management as Part of the Operating PolicyAs part of Loiste’s responsibility program, quality management creates a common foundation for quality work in our various business operations. We address the elements of quality management as part of all business-related processes, from procurement to monitoring.Quality management includes 6 basic elements:1. The starting point is the needs and expectations of our customers, whose fulfillment is essential for Loiste’s success.2. We keep Loiste’s assets reliable and available.3. In our operations, we comply with Loiste’s ethical principles, current regulations, and values.4. A competent and motivated staff is a basic prerequisite for our operations, and we want to be the most attractive workplace in the field.5. We monitor and measure the quality of our operations and are committed to continuous improvement.6. We extend the work in accordance with quality management to our partners as well and expect the same from them.The implementation of quality management is measured at various times based on the areas defined in the indicators.Development of GovernanceThe task of administrative services is to support the boards and business management of its client companies in finance, economics, information, and HR management, as well as in potential corporate arrangements. Its task is also to provide personnel and communication services to its clients to an agreed extent, and to coordinate competence development and project management.In addition, in collaboration with the boards, management teams, business management, and experts of different companies, it coordinates the development and maintenance of the Loiste companies’ business ecosystem. It is also responsible, to an agreed extent, for coordinating development work related to management and quality systems, as well as the group’s information management (quality, environmental, occupational health and safety, information and cyber security, and corporate responsibility activities).We are also developing administrative information access within our supplier value chain. We collect the data required by supplier requirements both in service management meetings and through a distributed online survey. The survey form complies with the ESRS standard.Statutory and Regulatory Requirements and Permit Conditions (Responsibility: CEO and ESG Controller)Legislative monitoring and other requirements for complying with regulatory guidelines are observed in conjunction with operational activities and committees. The committees report to the business units and the management team.Business units monitor the development of the legislation relevant to their respective business areas and are responsible for compliance with the legislation. This takes place by actively participating in the preparatory bodies of the industry association and by distributing materials related to changes in legislation within the organization as received from the industry association. In addition, legislative monitoring services are used, and at least once a year, the extended management team reviews any changes in legislation and how those changes will be taken into account in operations.Emergency, Disruption, and Accident Situations (Responsibility: Director in Charge of Continuity Management)In crisis situations, the separate crisis plan of Loiste Oy’s business companies is followed. The continuity management group reviews the up-to-dateness of the crisis plan for Loiste Oy’s business companies.Emergency, disruption, and accident situations related to the business are taken into account in the operating procedures of the business units. Identifying and providing instructions for these situations is the responsibility of the business unit.Emergency, disruption, and accident situations related to properties are addressed in the rescue plan. The rescue plan has been reviewed with the personnel by an external trainer.Statutory training is monitored by the business operations and arranged in cooperation with the HR unit.At least 5% of personnel must have completed first aid training. The HR unit is responsible for organizing this training.CommitteesVarious committees ensure and prepare compliance with standards, which is reflected in the day-to-day operations of all our business units. The role of the committees is to ensure that strategy and policies are taken into account in processes and to monitor the set operational quality indicators. The committees forward information within the organization using agreed procedures. The work of the committees and management is also evaluated through internal audits. The monitoring of processes is addressed in different committees:• Environment and Energy Efficiency and OHS Committee, as well as Continuity Management• Data Protection Working Group• Service Management and Steering GroupsTarget Programs and MeasuresTarget programs are set in the business units, which are approved by the business units and the group management. The follow-up of the target programs is carried out in various committees using indicators. The committees further share information for use by different business organizations and verify the indicators as agreed.Environment and Energy EfficiencyThe company’s goal is to improve energy efficiency and make environmentally friendly choices across its different business operations. We pay attention to waste management and final disposal, particularly focusing on hazardous waste and minimizing its generation. We measure and monitor proper handling of waste.The basic principle of our environmental and energy policy is to ensure responsible business activities from an environmental perspective. The policy also aims to care for the environment and minimize greenhouse gas emissions that contribute to climate change. The environmental and energy efficiency laws and regulations form the minimum requirements for our operations, which we supplement in accordance with the EU taxonomy and EU-level directive requirements.We use renewable energy sources as much as possible in heat and electricity production. In energy production, we strive for solutions that promote sustainable development and support energy efficiency and the use of renewable energy sources. In our business operations, we also take into account energy-saving measures.We promote the efficient use of energy both in our own operations and those of our customers. We maintain the competence of our personnel in environmental and energy efficiency matters. We consider environmental and energy efficiency when planning new investments. Our public website provides guidance on questions related to energy efficiency for our customers. We pay attention to continuous risk management. We regularly communicate about our environmental and energy efficiency measures.In terms of water usage in business processes, we take environmental impacts into account and improve water-related energy efficiency while minimizing water losses. Our responsibility extends to water usage, its availability, and water quality. We aim to minimize water consumption in properties and reduce wastewater generation.Regarding environmental risks, we engage in preventive measures. However, if an environmental incident occurs despite all preventive actions, we strive to mitigate its effects as quickly as possible, contact the relevant authorities, and openly communicate the development of the situation.Organization of Environmental ManagementThe impacts on the environment, as well as objectives and measurements, are monitored by the Environment and Energy Efficiency Group, which reports to the business units and management team. The management team includes representatives from each business unit, group governance, and company management.Identifying Environmental Aspects and Significant Impacts (Responsibility: Environmental Manager and ESG Controller)Information is reviewed and updated if necessary in meetings held four times a year, and the results are reported to the management team. The aim is to identify the most significant interfaces where the company’s operations affect the environment. The assessment of these aspects is also carried out when there are significant changes in operations or in the surrounding society. Dialogue regarding impact assessment is also conducted with stakeholders.Significant Environmental ImpactsBased on environmental aspects, the management team evaluates the significance of environmental impacts on both the business and the environment. These evaluations form the basis for preparing goals and objectives to be approved.Environmental ResponsibilitiesEnvironmental responsibilities and environmental permits are addressed, as necessary, in the business units’ operating instructions in the legal guidance portal and other internal channels for each business unit.ETJ, i.e., the Energy Efficiency SystemETJ+ (the Energy Efficiency System) is maintained and monitored by the Environment and Energy Efficiency Committee. Loiste companies are part of the energy efficiency agreement.Corrective and Preventive Actions, and Identifying OpportunitiesCorrective ActionsCorrective actions for processes and operations are initiated by the person responsible, within the scope of their authority, based on feedback, deviations, or other indications received. If necessary, the need for action is forwarded to development groups or management teams for consideration.Preventive Actions and Identifying OpportunitiesPreventive actions for processes and operations are initiated based on risk assessments. The actions are initiated by the person responsible, within the scope of their authority. If necessary, the need for action is forwarded to development groups or management teams for consideration. The development groups, management team, and process owners assess possibilities for improvement in relation to identified risks.Monitoring and Improving OperationsManagement Team WorkManagement TeamMeets twice a month. No meeting is held in July. The management team handles matters related to Loiste’s operational management. The operational management reports to the group’s Board of Directors.Four times a year, meetings address planning and monitoring of quality, environmental, and OHS issues, with an emphasis on HR-related matters. In addition to the aforementioned topics, these meetings cover the planning and monitoring of owner and customer perspectives as well as process development and HR matters across the business units.Composition: Business unit managers, HR manager, and financial controllers. Individuals responsible for sustainability, IT, and HR matters are separately invited regarding those areas.Environment and Energy Efficiency, OHS Group, and Continuity Management GroupMeets four times a year according to a predetermined agenda. Preparation work related to environmental issues is the responsibility of the Environment and Energy Efficiency Group. The group’s tasks include:• Creating and maintaining the energy policy• Defining energy objectives and targets• Defining targets for energy and site audits• Using the ETJ+ energy management system in compliance with its requirements• Reducing emissions and monitoring the achievement of sustainable development and CO2 neutrality• Continuity management controls and monitoring in business unitsThis committee, combined, also acts as an advisory body to the management team, with tasks related to the planning, monitoring, and development of HR and OHS matters. Meeting materials are available on the Teams channel. All meetings are documented.Monitoring, developing, and reporting on continuity management issues to the management team come separately from the business units.Business Unit MeetingsA steering and development group meeting is held monthly. In addition, various development or project group meetings are conducted.Management ReviewPurpose• The purpose of the reviews is to provide essential information about the group’s operations and development direction, as well as the suitability of the management system for guiding the group’s activities.• The goal of the reviews is to identify key development needs and make decisions on corrective actions.Scope• The management team addresses the entire group’s operations at the group level. Management reviews focus only on issues relevant to the company’s operations.Timing of Reviews• Reviews are conducted once a year, around September-October, in conjunction with the internal audit.Conducting the Review• Reviews are carried out according to an agenda and annual plan.• Successful reviews require thorough preparation.• Minutes are taken of the review meetings and made available to all personnel.StakeholdersCooperation with stakeholders affected by our activities is crucial for the company’s ongoing supplier evaluation process and for assessing material sustainability issues.Resource ManagementPersonnel (Responsibility: CEO, HR Manager)• Personnel in permanent employment within the group fall under the HR department.• We may also employ fixed-term workers, trainees, and students as needed and when possible. Consultative labor is also used when necessary.• The need for human resources is determined by the business management.Personnel Competence Requirements and DevelopmentFactors that affect the development of personnel competence include, for example:• Changes in the industry• General changes in society• Technological advancements• Changes in age structure• Changes in corporate structureAdditional training needs required by the business are assessed in several ways, including:• Statutory requirements• Competence needs identified in performance reviews• Needs arising from business strategies and goals• Needs identified in auditsThe impact of competence development is evaluated using various operational indicators.Planning Work Practices and TasksBusiness management plans work practices, which are documented in the management system. The planning of tasks is carried out by business managers. In task planning, we consider both business needs and the employees’ personal attributes.Salary, Incentive, and Recognition ProceduresSalary, incentive, and recognition procedures are described in our processes and internal documentation on the Intranet.Compensation PolicyGroup companies follow the applicable collective labor agreement. Salary increases are implemented at least in line with national wage agreements. The salary levels of different employee groups are reviewed annually by the CEO, unit managers, the HR manager, and the representative of the respective employee group. A performance-based incentive system is in use.Necessary Information, Availability, Maintenance, and Protection (Responsibility: IT Manager)GeneralInformation essential to the business is produced and stored in various IT systems. In addition, important data is stored, for example, on paper, in recordings, and in images. The handling of records and documents follows the document management guidelines described in the operating procedures.Protection of Documents and RecordsPaper documents are stored in a separate fireproof archive area with controlled access. Other recorded materials are stored in a fireproof location and, wherever possible, converted into electronic format. Such records include drawings, audio recordings, slides, photos, videos, etc.Protection of Electronically Stored DataPhysical protection, access control, burglary protection, and fire alarms are described in separate operating procedures. External threats to data are addressed through firewall protection of data communications. The IT department is responsible for this implementation.Measurement, Analysis, and Improvement (Responsibility: CEO)Monitoring, Measurements, and Operational ResultsDay-to-day operations are carried out by company personnel in cooperation with their supervisors. The supervisors’ and other responsible persons’ job descriptions include daily monitoring and oversight within their respective areas of responsibility. A more detailed description of daily oversight is provided in the operating procedures and processes for each area of responsibility and process.Monthly, or according to another defined schedule, the measurement results for the critical success factors of each area of responsibility are reviewed in business and support unit meetings and collectively at the management team meetings for Loiste Oy’s business companies.The quality of telephone services delivered by customer service is monitored by the service provider. A detailed description of this process is found in the customer service process descriptions.The results of quality assessments are analyzed by the person responsible for customer service (for operational monitoring and development).Supervisors’ and other responsible persons’ job descriptions include guiding personnel and developing competence within their area of responsibility. In addition to ensuring that work tasks proceed smoothly, supervisors must monitor their staff’s well-being and ensure that occupational health and safety objectives are met. They are supported in this work by their own supervisors, the group’s CEO, the HR manager, the group’s occupational health and safety guidelines, and the management team. Employee well-being is regularly monitored through measures such as staff barometers and workplace climate surveys.The entire staff contributes to the development of products, services, and processes within their own areas of responsibility. Targets set for products and services, as well as the indicators used to track performance, are described in the operating and work instructions of each business and support unit.Process performance is monitored daily by the individuals responsible. Monthly, they report to their supervisor or the business unit’s management team on progress toward process targets using the indicators described in the process cards.Regular service management and review meetings are held with the most significant partners and suppliers to assess and develop the collaboration. For other suppliers and partners, monitoring and development of their performance is the responsibility of the individual who uses their services.With the assistance of their supervisors, the responsible individuals must each ensure that the environmental objectives set are achieved. At the group level, the monitoring and guidance of environmental objectives are carried out by the quality management team.Data Analysis, Identifying Opportunities, and ImprovementData analysis and corrective actions are the responsibility of the respective business units. If needed, issues are addressed in the group’s management team. Procedures for handling any non-conforming products or services are described in the operating procedures. Business units decide on their own development projects based on their objectives and goals.Joint development projects that involve multiple business units and support services are initiated based on a decision by the group’s management team.AssessmentsInternal Assessments/AuditsWe monitor our operational level and compliance with the management system requirements through internal assessments. The assessment team consists of an external evaluator, a process owner, and the ESG Controller. This ensures that sufficient time resources are allocated to the people involved for conducting the assessment properly. We regularly monitor operational levels and compliance with the management system requirements through both internal and external audits.The purpose of an internal assessment is to inform company management about any development needs within the management system and processes. In addition, the assessor’s role includes a consultative aspect to help promote effective and high-quality operations in every possible way.The internal assessment program is available to all employees internally.External Surveillance Evaluation/AuditAn external surveillance evaluation is conducted once a year according to the plan provided by the external evaluator. The ESG Controller handles the practical arrangements for the surveillance evaluation. The documentation of the external surveillance evaluation is stored internally for all personnel to access. Auditing is performed once a year according to the schedule and audit program provided by the external auditor.Risk AssessmentsRisk assessments are performed as part of daily work under supervisory duties. Any identified risks must be reported without delay to business management. Risk assessments are then conducted by the business units and/or the group’s management team. Related documentation is attached to the minutes of the management team meetings. The company has a separate risk policy.
[Social]
[Governance]
[Environment]
Risk Policy GOV-5 (Responsibility: Board of Directors)Investigation, Monitoring, Analysis, and Assessment: Business Units Review: Management Team Reporting: Group Board of Directors Prepared: 2022 Amendment Update: 2024 A review is conducted and reported to the Board at least once a year.The risk policy covers the following areas for the entire value chain and the Loiste Group:• Management systems and owners• Environmental risk assessment• Social and OHS risk assessment• Governance risk assessment• Strategy resilience to climate-related risks• Identification of climate-related transition risk• Assessment of the impacts of climate-related transition risks• Identification of physical risk• Assessment of the impacts of physical risks• Identification of climate-related physical risk• Assessment of the impacts of climate-related physical risks• Identification of climate-related opportunities• Assessment of the impacts of climate-related opportunities• Monitoring the level of environmental protection• Monitoring social and OHS performance• Monitoring governance performance• Finance, IT management, and cybersecurityThe Group has separate risk management guidelines for each business unit.In the risk assessment process, the following are carried out:• risk identification,• materiality assessment,• the business’s ability to withstand climate change,• impact assessment,• identification of opportunities,• scope and monitoring plan, and• regular measurement and follow-up.The scope of analysis is described in more detail in the context of risk and opportunity management.In the risk identification process, negative impacts are prioritized based on business continuity and financial impact as well as their relative severity and probability. The impacts of opportunities are assessed based on their relative scope and likelihood. In addition, it is determined which sustainability issues are significant to ensuring business continuity, making investments, and reporting. The probability, magnitude, and nature of identified risks and opportunities are assessed by examining market observations, financial forecasts, legislation, strategy, and ownership guidelines in combination. Risks related to sustainable development, the effects of climate change, and climate mitigation are prioritized highly compared to other types of risks, as the Loiste Group’s strategy is based on sustainable development, with a strategic goal of achieving carbon neutrality in its own operations by 2026. The process of identifying, assessing, and managing impacts, opportunities, and risks is integrated into the general risk management process and is used to evaluate the general risk profile and risk management procedures.Additionally, the policy takes into account separate risk management guidelines for individual business units. The Risk Policy and its appendices contain the following policies: Continuity Management, Production Risk Policy, Production Risk Mandate, Crisis Management Rules and Guidelines, REMIT Compliance – Inside Information, Cybersecurity, Authorizations and Information Security Risk Management, Environmental Risks, Social Risks, and Governance Risks.Risks are assessed during business processes in different business units and across process areas, and efforts are made to prevent and manage them in the best possible way in both our own operations and in partner management. Monitoring regulations and guidance is part of process management, as are reporting observations and deviations, identifying development areas, and implementing improvements. Risks are analyzed and updated for negative impacts and opportunities in the business units at least twice a year and reported both to the common business management team and the group’s board after analysis and updates. At the same time, the effect of the identified risks’ negative impacts and opportunities on the business and strategy is updated. The assessment process is included in the annual schedule, and the process is carried out in the same way each time, taking into account changes in the operating environment. There are no changes to previous methods.Risk management involves controlling identified risks by various means such as eliminating or reducing risks. The Risk Policy and its various components include a description of the risk management method. The Risk Policy identifies the risks of different business units and describes the tasks and processes for detecting, preventing, and taking corrective actions related to risks and opportunities. It also defines measurement and scheduling as well as risk classification. The Risk Policy sets out the procedures for achieving the desired intent. Internal control is a form of management that ensures personnel and processes operate correctly and in compliance with the law. The Risk Management Policy provides guidance for internal control and risk management. Responsibility for risk management lies with the Group’s Board of Directors. Risks are regularly dealt with twice a year by the Group’s Board or more often if necessary. Risks are analyzed and updated by business unit, and the joint management team of the business units reviews the updates before the board meeting. The Risk Policy is described in a separate document.Company Stakeholders and Risk PerspectiveThe company’s value chain and the success of various stakeholder relationships significantly influence the company’s operations and the achievement of its objectives. The company’s operational risks can be viewed from the perspective of stakeholder relationships being compromised.Risks associated with different stakeholder relationships are discussed in more detail in the risk management information.Responsibilities in Risk ManagementResponsibility for risk management lies with business unit management and the Board of Directors. Operational working groups assess risks, materiality, and the operating environment, reporting forward within their organizations. Responsibility for risk management rests with every employee in the organization. Each employee is obliged to report observed risks that threaten the company’s objectives or the well-being of personnel and the environment. The obligation to inform at least one’s supervisor is not limited by internal business or company boundaries. Any identified risks must be brought to the attention of business management without delay. Risk assessment is thus carried out in the business units and/or the Group’s management team. Relevant documentation is appended to the management teams’ meeting minutes.Within the Group, the following working groups and responsible persons can be contacted to raise issues that need attention or resolution:I Environmental, Energy Efficiency, and Climate-Related Risks: Environment, Energy Efficiency, and OHS Committee• Chaired by the Production Manager• Convenes four times a year and includes representatives from all business units plus an external assessor• Tasked with coordinating the Group’s environmental matters and evaluating the Group’s environmental risksII Electricity Trading and Risk Management: Energy Production• The group includes representatives from the service provider, the Loiste Energia Oy Business Director, and the Production Manager; the Group’s CEO and other individuals may also be invited• Meetings are intended to be held weekly, at least once a month• Tasked with coordinating the management of risks related to electricity trading in accordance with the risk management policy set by the Board• The group reports to the Board through the CEOIII Social Risks Related to Staff and Stakeholder Well-Being: Environment, Energy Efficiency, and OHS Committee• Preparatory responsibility lies with the Occupational Safety Manager• Includes representatives from all business units plus an external assessor• Tasked with coordinating statutory and other matters relating to staff and staff well-being• The committee reports to the Management Team, authorities, the CEO, and staff as appropriateIV Communications, Corporate Image, Governance Risk• Group Management TeamV Business Risks, Strategy, Physical Risks, Climate-Related Transition Risk, Governance Risk: Management Team and Group Board• Chaired by the CEO• Includes representatives from each business unit• Responsible for systematic, goal-oriented development of risk management and increasing organizational knowledge of uncertainties related to business operations and how to limit those uncertainties, for example, coordinating actions based on risk mapping, updating the company’s insurance coverage, and managing insurance-related eventsVI Information Security• Group IT Manager, reporting to the CEO• Data Protection Working Group, which meets at least three times a yearVII Properties• Person responsible for the Group’s properties, reporting to the CEOVIII Contracts, Supplier Management• Business unit managers and contract managers• The law firms used by the GroupIX Risks Related to Changes in the Business Environment: Group Management Team• Business unit managers are responsible for developing their units and responding to identified risks• The Group Management Team is responsible for developing the business in line with targets set by the owners• The Group Management Team is chaired by the CEO, who reports to the BoardProcess Risk PerspectivesIn a process-based organization, the primary responsibility for considering risk management perspectives within a process lies with the process owner.Process risk perspectives are the same as considerations related to balancing the company’s stakeholder relationships. These previously mentioned points can be further broken down into more detailed aspects in process risk management.Some perspectives on process risks include:• Ensuring sufficient flow of information within a process and at the interface between processes• Business information security aspects, risks related to subcontracting and partnerships, such as information security, key personnel, contract risks, and image risks in all activities; do implemented solutions support the desired corporate image?• Risks related to staff competence; is the right kind of expertise at a sufficiently deep level available?• Staff capacity for development; are there enough human resources capable of evolving to meet future skill requirements?• “Dangerous work combinations” in processes where performing and monitoring tasks fall to the same person• Backup arrangements; is there critical information in the process that only one person knows, with no backup system?• Changes in the operating environment; are we developing the process to meet yesterday’s challenges instead of tomorrow’s, and how do we ensure timely detection of changes in the business environment?• Equipment functionality; is there sufficient reliability for critical equipment or data connections from the process’s perspective?• Climate-related transition and physical risks to ensure business continuity• Cybersecurity issues in our own business and with stakeholders• If the functional means to reduce financial uncertainty to a reasonable level do not exist, can the risks be insured or otherwise safeguarded?Continuity Management PolicyGeneralIdentifying physical risk is part of continuity management. Physical risk can arise from climate change, vandalism, or other physical disruptions to assets. Loiste’s products and services are produced through a network of multiple actors. The operational capacity and reliability of the entire Loiste network is improved by developing the operational reliability of every organization within the network. Maintaining and developing the operational capacity of the Loiste network also contributes to the security of supply in our society.Continuity management encompasses all measures by which Loiste, through planned and implemented arrangements and its management system, manages various disruptions that threaten its operations. Loiste’s continuity management procedures ensure, for its customers and stakeholders, the availability of products and services under various disruption scenarios and during exceptional circumstances.Loiste’s continuity management consists of the risk management and continuity planning of its different business and support functions and core processes, as well as recovery planning for the various IT and communication services and solutions that support them, plus crisis management planning.The continuity management system (applying BCMS, SFS-EN ISO 22301:2014) is part of Loiste’s management and quality system (applying SFS-EN ISO 9001:2014). It is where the continuity of business units and core processes is planned, implemented, operated, monitored, reviewed, maintained, and improved. The management system includes the organizational structure, policies and principles, planning activities, responsibilities, procedures, processes, and resources. Loiste’s management system, together with the associated Loiste continuity management system and its procedures, is therefore documented and made available to the organization via Loiste’s internal channels.Loiste’s continuity management is management and expert work that:• Identifies risks, disruptions, and dependencies in its business and support functions (risk management),• Plans, organizes, and implements procedures for different disruption scenarios (preparedness and readiness plans, ICT recovery plans),• Ensures that its critical partners can operate under disruption conditions (contract-based preparedness – use of SOPIVA recommendations in partnership agreements), and• Protects its business interests and value creation capability.Loiste utilizes the National Emergency Supply Agency’s HVO Extranet portal and SOPIVA recommendations in its continuity management.Continuity Management ObjectivesLoiste’s management and quality system aims to ensure safe, sustainable, reliable, and cost-effective operations, products, and services, taking into account their entire life cycle and the functionality of its own processes, partners, and customers.Another objective is to deliver sufficiently high-quality products and services to its customers at the lowest total cost, considering direct and indirect costs, ensuring smooth operation across different activity chains, and systematically developing collaboration with various suppliers and customers.By systematically developing continuity management, Loiste:• Reduces costs arising from various operational interruptions,• Creates confidence in different disruption situations regarding the ability of its responsible persons and partners to act,• Improves efficiency in different disruptions and speeds up recovery,• Increases the competence of those responsible for operations development, and• Maintains its reputation as a reliable supplier and partner.Loiste’s continuity management also takes into account its other policies and guidelines related to infrastructure, information systems, and reporting.Wherever possible, Loiste’s various units share, utilize, and jointly develop operating models, information systems, processes, and best practices.Loiste’s continuity management operates as planned and meets its objectives when all of the following areas are in order:Leadership1. Loiste has identified the core factors, obligations, and dependencies that guide the continuity and management of special situations in its core functions.2. Requirements for continuity management, imposed by core functions, have been defined.3. Management requires continuity management planning for core functions and critical support functions.4. Continuity management is organized and assigned as part of normal leadership, operations, and management of the partnership network.5. Coordination of continuity planning is assigned.6. Resources have been allocated to meet continuity management targets.7. Continuity planning is carried out in collaboration with core and support functions as well as critical partners.8. Responsibilities and operating models for communication and reporting with key stakeholders have been defined and organized.9. Management monitors the development of continuity management, continuity planning, and the effects and costs of measures.Operating Principles1. The management of special situations is organized, instructed, and included in the management and quality system and the operating models described therein.2. Loiste’s interaction with its operating environment is taken into account in its activities.3. A regular risk management procedure is in use.4. The results of risk management guide the development of continuity management.5. Continuity management measures support the objectives of Loiste’s core functions.6. The continuity of services within Loiste’s operational network is planned and agreed upon.7. Procedures for managing special situations are planned and described in Loiste’s management and quality system.8. Crisis communication procedures are described and practiced in Loiste’s Crisis Plan.9. Instructions for managing disturbances in critical core and support functions have been prepared, employees have been trained, and the procedures have been practiced.Human Resources1. Role- or task-specific requirements have been set for continuity management competence; the level of expertise is known, and it is being developed.2. Loiste encourages staff to follow and develop a sound continuity management and information security model.3. Loiste has agreed on a method for monitoring operations, reporting security incidents, and handling misconduct.4. The key roles and individuals in Loiste’s core and critical support functions have been identified and backup arrangements planned.5. Loiste’s own personnel and its use are planned and dimensioned, at least for core and critical support functions and partnerships, in accordance with the requirements of continuity management.Partnerships1. Partners, subcontractors, and resources critical to Loiste’s operations and services have been identified.2. Contracts include requirements for implementing continuity management.3. The obligation to manage continuity in critical operations extends to the most essential supplier network (critical partners in terms of continuity management).4. Cooperation with partners to manage disruptions and special situations is organized and assigned.EvaluationThe implementation and appropriateness of Loiste’s continuity management are regularly monitored and evaluated.Continuity Management OrganizationLoiste’s Environment, Energy Efficiency, and OHS Group coordinates the different areas of continuity management under the leadership of the person responsible for continuity management, ensuring that the activity is clearly organized and integrated into Loiste’s management and quality system.Coordination of the different areas of continuity management is undertaken by the Continuity Management Group established by Loiste’s Environment, Energy Efficiency, and OHS Group, which includes (the stakeholder group to be managed):• Those responsible for continuity management in the business units (Continuity Management Group),• The HVO Extranet contact person (responsible for various aspects of the maturity analysis),• The person responsible for preparedness and contingency planning (preparedness and contingency managers),• The individual responsible for risk management (business and support unit leaders), and• Those responsible for information systems, communications, and cybersecurity (system owners).A key aspect of Loiste’s continuity management is the self-assessment of various areas (HVO Extranet, Vahti, business and support function risk analyses) and the resulting development, recovery, and crisis plans. These enable the individuals responsible to evaluate the current state of Loiste’s operations and those of its partners, set development goals, and systematically monitor development progress. Implementation of the development plans compiled by area of responsibility is regularly monitored in the Quality and Environment Committee.Planning related to security of supply is carried out under the leadership of Loiste’s preparedness and contingency manager, involving those responsible for preparedness and contingency in Loiste’s various business units.In analyzing and developing operations, Loiste uses the HVO Extranet portal maintained by the National Emergency Supply Agency, through which Loiste’s maturity analyses are updated annually. Using the maturity analysis and report, Loiste obtains information on the susceptibility of its operations to disruptions and its operational dependencies, as well as comparisons with other industry actors for its own development planning. The HVO Extranet portal also provides instructions and bulletins to support Loiste’s continuity management development. The HVO Extranet contact person is responsible for maintaining the HVO Extranet portal and conducting the annual maturity analysis.When working with and signing contracts with critical partners, Loiste applies the SOPIVA recommendations maintained by the National Emergency Supply Agency. The objectives of maintaining and using these recommendations are to:• Provide the contracting parties with common basics of continuity management and a shared language, and to support integrating related procedures into companies’ service management and daily operations.• Maintain a mutually beneficial operational situation for the contracting parties.• Improve delivery reliability for products and services produced across various networks.• Enhance the operational reliability of the company, its operational network, and critical stakeholders, as well as society’s security of supply.Loiste’s continuity and recovery planning for its information and communication systems, as well as cybersecurity, is secured under the direction of the person responsible for these areas and the system owners (annual updates of analyses, recovery plans, and their review within the System Owner Group). Cybersecurity is a dimension of security aimed at ensuring the safety of an electronic and networked society. The goal is to identify, prevent, and prepare for the impacts of disruptions to electronic and networked systems on society’s and Loiste’s critical functions.The planning and development of Loiste’s crisis and risk management is coordinated by the individual responsible for risk management, together with the leaders of the business and support functions. Risk management is integrated into Loiste’s strategy and management processes as well as planning and reporting. The business units are responsible for crisis plans, crisis management development, related reporting, and practicing these efforts with the support of the Environment, OHS, and Continuity Management Group. Managing risks and crises involves identifying, analyzing, and financially overseeing risks threatening Loiste’s revenue streams, assets, or personnel. Assets to be protected include Loiste’s fixed assets (buildings, land, energy transmission and distribution networks, production facilities, etc.), movable property (equipment needed for Loiste’s operations, vehicles, documents, data, etc.), and intangible property (expertise, corporate and trade secrets, reputation, brand, etc.).Loiste Companies’ Information Security Policy Updated: 2023 The Information Security Policy covers all of Loiste’s business activities and extends to partner management. The primary goal of Loiste’s information security is to ensure the continuity of operations under all circumstances. Information security must enable the availability, integrity, reliability, and confidentiality of information systems and data under all conditions and in all business processes.In data processing, we exercise appropriate care and adhere to laws and regulations as a minimum requirement. Information security in all its facets meets at least generally accepted practices. Staff awareness of information security is maintained and developed through training and communication.We actively monitor developments in information security and incorporate the insights we gain into our operations. We develop information security in cooperation with our partners and stakeholders.Risk AssessmentRisks related to data processing are regularly identified and analyzed, and corrective measures are taken, for example, by updating guidelines. Business impacts are considered during risk assessment. Risk assessment is part of acquiring new systems, managing partners, and controlling changes in the industry.Misuse of or attempts at misuse of information security are systematically reported to top management. IT risks are regularly reviewed internally and with partners.1.2 Classification and Handling of InformationLoiste uses a data classification method that defines how information should be classified, what information security controls exist, and how data should be handled. The guidance also includes instructions on information storage and archiving. Loiste uses the Digiturvamalli model for information management and information security work.1.3 Processing of Personal DataData processing guidelines and the privacy policy define how personal data should be handled and stored. Different workflow and system guidelines specify where and by whom personal data is processed. GDPR matters are regularly reviewed in the Data Protection Working Group. The system and application development processes include stages for analyzing data protection requirements applicable to the purposes of personal data use. Deviations identified during checks on data usage are reported without undue delay to service providers, counterparts, or individuals in accordance with directives and laws, along with any corrective measures taken.1.4 Information Security RequirementsInformation security and technical matters are handled by an external partner responsible for the technical aspects. We have a 24/7/365 CSOC service in place. The level of information security must meet the specified requirements and is regularly monitored by administrative and technical means. We utilize and keep track of national data protection and information security bulletins from Traficom in our regular IT management meetings. We report any security, information security, or data protection incidents or threats thereof to company management, partners, and, if necessary, authorities without undue delay.1.5 Information Security Requirements under EU Directive NIS2The latest version of the Network and Information Systems Directive (NIS2) approved by EU member states on November 10, 2022, sets cybersecurity requirements for critical infrastructure across the Union and guarantees uniform sanctions. The Directive will be applicable from 2024 onward. NIS2 is to European cybersecurity what GDPR is to European data protection. NIS2 adds new requirements for organizations in four primary areas: governance, regulatory reporting, risk management, and business continuity. The aim is to enhance Europe’s capability to withstand current and future cyber threats.Governance Management must be aware of and understand the directive’s requirements and risk management measures. They have direct responsibility to identify and address cyber risks in order to comply with requirements.Reporting to Authorities Organizations must have established processes to ensure proper reporting to authorities. For example, major incidents must be reported within 24 hours.Risk Management To meet the new requirements, organizations must implement measures to minimize risks and consequences. This includes incident management, improved supply chain security, network security, access control, and encryption.Business Continuity Organizations must consider how to ensure business continuity in the event of major cyber incidents. This includes system recovery, emergency measures, and establishing a crisis management team.In Loiste Companies, to ensure compliance with the NIS2 Directive, at a minimum we:• Have a procedure in place for responding to an information security incident. This means, for instance, that backups must be current. We have also prepared recovery plans for critical ICT systems.• Include practices for handling and reporting vulnerabilities as part of system procurement.• Provide regular information security and data protection training for our staff.• Include encryption usage guidelines and procedures in Loiste’s information security instructions.• Control and manage user permissions in line with job roles, ensuring their oversight.• Include in partner contracts the possibility of conducting security clearances for personnel working for Loiste.• Use an IT system management tool and configuration management system for ICT assets, ensuring they are used and handled correctly.• Use two-factor authentication (2FA) in ICT systems.1.6 TrainingStaff are trained during the onboarding phase, and information security issues are revisited as part of process controls in partner management. Partners receive information security updates and additional training as necessary.Cybersecurity, Authorizations, and Information Security Risk Management and MonitoringTechnical management and auditing of cybersecurity are handled through partners, with regular reporting and alert mechanisms in place. Access management uses MFA (multifactor authentication) wherever possible. The IT auditor conducts reviews on a regular basis. Backup and related practices are provided by a partner.Continuity and recovery planning for Loiste’s information systems and communication systems, as well as cybersecurity, is ensured under the direction of the individual responsible for these areas, involving system owners (annual updates of analyses, recovery plans, and their review with those responsible for processes). Cybersecurity is a dimension of security aimed at ensuring an electronic and networked society’s safety. The goal is to identify, prevent, and prepare for the impacts of disruptions to electronic and networked systems on society and Loiste’s critical operations.In data processing, we exercise appropriate care and treat laws and regulations as the minimum standard. Information security in all its facets meets at least generally accepted practices. Staff knowledge of information security is maintained and developed through training and communication. Data processing risks are identified and analyzed, and corrective actions are taken (e.g., updating guidelines). • We actively monitor developments in information security and apply insights to our operations. • We develop information security together with our partners and stakeholders. • Technical management and audits of cybersecurity are conducted via partners with regular reporting and alert mechanisms. • MFA (multifactor authentication) is used wherever possible. • The IT auditor performs regular reviews. • Backup services are sourced from a partner. • Information security and technical matters are handled by an external partner that manages technical solutions, continuously monitors technical security, and reports to the Group (CSOC). • Misuse or attempted misuse of information security is systematically reported to top management. • The System Owner Group reviews information security issues, conducting risk assessments and follow-up on IT matters. • GDPR matters are reviewed in the Data Protection Working Group. • IT risks are regularly reviewed internally and with partners.User Access and Data AccessUser rights and access to data are managed in collaboration with the IT partner:• User rights and employee accounts are governed by a standardized process with a three-step approval method.• Access rights are personal; there are no general shared IDs.• Access rights are defined according to usage needs and job descriptions.• Access rights are regularly reviewed both internally and during the external IT audit.• By default, access is granted only to what is necessary for work.• Data may only be used for performing job duties.• User knowledge of information security must be maintained through regular training.• Access rights change when a job description changes. The user’s supervisor is responsible for notification, and the change is managed via the same standardized process.• If access rights are no longer needed, the user’s access through firewalls is terminated immediately upon notification.• User access creation request: o The request is initiated/first approved by the user’s supervisor or an equivalent responsible person. o Then, the request is verified and approved by Loiste’s IT department. o The request’s content and the individual’s role and job description are verified. o The individual’s contact information, email, and phone number are confirmed. o Finally, the service provider creates the user in accordance with the request and notifies that the access is set up. o The granted rights and scope can be reviewed.• User access termination request: o The request’s content, role, and job description are verified. o The individual’s contact information, email, and phone number are confirmed. o The user’s supervisor or an equivalent responsible person requests termination. o Then, the request is verified and approved by Loiste’s IT department. o Finally, the service provider removes the user’s access as requested and notifies the request initiator and the IT department. o Ongoing validity can be reviewed.Usernames and Passwords• Passwords must be at least 12 characters long, including special characters and numbers.• Shared or common usernames and passwords must not be used.• Passwords must be stored carefully.• If there is any suspicion that a password may have been exposed to outsiders (e.g., through phishing), the password must be changed immediately.• Multifactor authentication (MFA) is used wherever possible.2.2 Network Communications/IntegrationsNetwork traffic is VPN tunneled whenever possible. Integrations are carried out via the Client’s integration platform. The Client’s systems are used and connected with according to separately agreed procedures. In addition, critical communication connections are redundant and monitored.2.3 SystemsThe supplier must protect the systems used in service operations with modern methods, considering information and physical security. The system’s data must be backed up in such a way that the system can be restored to an operational state without significant data loss. Equipment critical to operations must be redundant. Direct external access to critical systems by a user or external network traffic is not permitted. A written recovery plan must be created for critical systems, and the plan must also be tested in practice. Major systems must have testing environments and log management. Systems are continuously updated by the service provider, and firewalls and information security are continuously improved.OtherThe Client has the right to audit the above-mentioned matters. The supplier must immediately inform the Client’s representative of any deviations.Insuring cybersecurity involves managing residual risk, which in an IT environment should ideally be minimized. This is because lost or corrupted data may not always be recoverable. Consequently, we focus on preventative procedures that protect valuable business information and ensure sufficiently quick recovery from malfunctions. For instance, we use:• A modern backup service in which data is transferred to and stored in a data center 200 km away (ISO 27001 certified partner).• A virtualized server environment that allows software-based server backups, enabling rapid recovery. Additionally, critical systems are redundant, so operations usually continue without issue from a user perspective in problem situations. The server environment’s hardware platforms are also redundant.• A CSOC (Cyber Security Operation Center) service, where the information security level of our critical equipment is monitored by our security partner (ISO 27001 certified) in a control room, and any critical anomalies are responded to immediately.• An up-to-date redundant firewall environment that generates continuous logs for the CSOC. Partner connections are made using secure VPN connections.• Our partner companies’ users access our applications via a virtualization platform, meaning they do not have direct access to our network.• Information security audits.• Our ICT environment is covered by traditional property and business interruption insurance.Evaluating insurable residual risk and maintaining appropriate insurance coverage is a collaborative effort between IT management and finance. This includes periodically assessing the need for cyber insurance.Dealing with DeviationsDeviations are dealt with immediately in cooperation with partners; other deviations are addressed in the process as corrective or development measures.Organization, Roles, and Responsibilities Related to Information SecurityHardware and applications that belong to information systems are managed via partners. The contracts include descriptions of access management, logging, and GDPR reporting. Any handling of personal data must be done with particular care and caution. Log monitoring must be possible, and logs must be retained and disposed of in accordance with applicable law. Agreed practices for cybersecurity and data protection apply to hardware and application partners. Contracts oblige service providers to manage access control, designate responsible personnel, and provide training to ensure information is not disclosed to unauthorized parties during service delivery. This covers the start, operational period, and maintenance or disposal of data media. When disposing of media, the service provider is responsible for proper access management and destruction processes. Service providers must sign a data processing agreement and a description of processing activities that comply with EU data protection regulations.Loiste companies operate in a network of various service providers. These providers handle fundamental processes for the business units in areas such as customer service, contract management, and billing, as well as IT system services. Each has specifically defined role-based permissions to access data. Role-based openings, changes, and closings of permissions are carried out through a standardized and documented process (described in section 2.1). The network environment is protected with robust firewalls, monitoring, and two-step authentication.Loiste companies have a designated person who, in cooperation with the service provider, ensures operational and hardware/software data communication security throughout the lifecycle. There are regular meetings with service providers to review observations, deviations, development areas, and risks.
(ESRS 2-MDR-P) The scope of this policy applies to all business operations, aiming to make the upstream portion of the value chain, procurement, and our own production as carbon-neutral as possible, while also committing suppliers insofar as they participate in Loiste’s projects or Loiste’s procurement chain.By implementing our strategy, we reduce greenhouse gas emissions, benefiting our customers, owners, financiers, and local residents. In addition, we support the national transition toward a low-carbon society.The Board of Directors of the Loiste Group has outlined and approved a sustainable development strategy/policy. The strategy defines the target state and the methods by which the community and suppliers commit to ESG principles. By committing to the CSRD directives and the related standards and principles, our company publicly expresses its commitment. To support this commitment, our business operations are guided to follow the EU taxonomy and ESRS standards and other reference frameworks.(ESRS 2-MDR-A) Net zero target: Our goal is to be carbon-neutral by the end of 2026 in our own operations. Loiste Lämpö is investing in CO2-free district heating production.1. SCOPE 1: The target is a -100% reduction by 2026, by which time our own heat production will be ready.2. SCOPE 2: CO2-free from 2024 onward.3. SCOPE 3: Reduced by less than 10% from 2023 to 2030. This depends on the preparedness of suppliers and contractors to achieve carbon neutrality.We measure the target level relatively as a percentage from 2023. The scope includes the entire value chain, both up- and downstream. Operators are located in Finland, so the geographic scope is national. The starting point is 54,267 tons CO2e, and the 2030 target is 3,311 tons CO2e. The method is based on investments in our own operations; the scenario does not assume any hypothetical data, nor does it rely on speculative calculations regarding the company’s environmental objectives. We require that our main contractors commit to reducing their own emissions (SCOPE 3). We monitor, measure, and calculate emissions and assess progress annually. The largest financial impact for SCOPE 1 is the investment (CAPEX), and the CO2 emissions tied to constructing the investment are reported as part of the 2026 emissions. The equipment and materials must meet the minimum value requirements of the EU taxonomy regulation. The SCOPE 1 emission reductions in our own production are based on new technology in district heating production that utilizes waste heat from data centers and heat produced with carbon-neutral electricity. SCOPE 2 is already carbon-neutral energy consumed in our own properties (OPEX). For SCOPE 3 in OPEX and electricity network business CAPEX, we have asked suppliers how the biggest suppliers can reduce greenhouse gas emissions by 2035. After 2026, we will no longer purchase district heating from Kainuun Voima Oy, which has produced it using coal, peat, oil, or gas in addition to biofuel. Our target for carbon-neutral district heating production is by the end of 2026. This investment is already underway. (SBM-1) The company’s strategy is largely based on transforming district heating production to CO2-free (net zero) and aiming for carbon neutrality among suppliers in the value chain in line with the strategy for SCOPE 3. These are significant for sustainability and affect the timeframe set in Loiste’s sustainable development strategy, particularly for SCOPE 3, where stakeholder challenges are greatest. Measurement and verification (ESRS 2 - MDR-M) are carried out such that SCOPE 1 is verified by an external auditor (KIWA Inspecta), SCOPE 2 certificates are obtained from energy suppliers, and SCOPE 3 data are either obtained from suppliers or calculated using the Position Green application.We are committed to supporting Finland’s transition to carbon neutrality by 2035. In line with our strategy, we are also investing in solar power. We enable our customers to switch to renewable energy by developing the electricity grid to meet changing needs. We are committed to preventing both our own environmental risks and those arising from climate change. We participate in social initiatives where we can make a difference and leverage our expertise for the benefit of the climate. We also require our partners to take concrete actions to achieve a CO2-free Finland and to act responsibly within the value chain according to ESRS standards.Guidelines:• We are committed to preventing both our own environmental risks and those arising from climate change. We are a responsible renewer of energy infrastructure, complying with environmental, social, and governance responsibility principles.• We are involved in moving toward a low-carbon and resource-efficient society by promoting the adoption of renewable and innovative forms of energy production and storage.• Our climate commitment: Concerning the climate change strategy, we are committed to supporting Finland’s transition to carbon neutrality by 2035.• Our goal is to be carbon-neutral in our own operations by 2026. (Indicator: procurement contracts and emissions calculations)• We are also investing in and building wind power.• We are committed to preventing environmental risks and the risks posed by climate change.• We are committed to the UN Human rights, Climate Agreement, EU Taxonomy directives, OECD standards, CSRD directives, and other requirements stemming from sustainable development within ESG.• We participate in social projects where we can have an impact and where we can utilize our expertise to benefit the climate. We enable a green transition for our customers by developing the electricity grid to meet changing needs.• We also require our partners to take concrete actions toward achieving a CO2-free Finland and to act responsibly throughout the value chain in accordance with ESRS standards. (Procurement Policy)• Loiste companies require that companies providing services to Loiste take care of the following areas:• Responsibility, good governance, operational quality, environmental impacts, occupational health and safety, respect for human rights, prevention of corruption and bribery.• We include requirements for sustainable development and “green financing” in plans for new investments.• We certify structures and services according to ESG (Environmental, Social, and Governance) requirements.• We enable our customers’ green transition by developing the electricity grid to meet changing needs.The company’s strategy is updated annually, and its main focus areas are regularly reviewed as part of the sustainable development strategy. Plans related to these areas are reviewed, updated, and monitored regularly in the business processes. The Group’s Board of Directors is responsible for the Group strategy. The CEO is responsible for preparing and implementing the strategy, delegating responsibility for business strategy planning to the business directors. The CEO prepares the strategy and implements it together with the Group’s management team. Employees within the organization are involved in strategy preparation. Implementation of the strategy is regularly reviewed with all personnel. A schedule is drawn up for the measures included in the strategy, and responsible individuals are assigned. The business plans of each unit are part of the overall strategy. Strategy implementation is guided and priorities are set in monthly management team meetings. Responsible individuals keep the strategy management monitoring tools up to date.The sustainable development strategy/policy covers the following environment-related topics, in which we strive to develop and improve our operations and reduce the risks caused by our activities:• Air pollution: We will transition our operations to be emission-free according to the set target.• Biodiversity and habitats: We protect habitats and biodiversity in the areas where we operate.• Contaminated land: We do not pollute the soil, and we protect our equipment from soil emissions.• Energy: We operate with high energy efficiency and require our equipment and suppliers to do the same.• Greenhouse gas emissions: We will transition our operations to be carbon-neutral in line with the set target.• Hazardous substances: We minimize the use of hazardous substances where possible and monitor our equipment.• Light pollution: Our operations do not cause light pollution.• Material procurement and resource efficiency: Our procurement policy guides purchasing and supports the circular economy.• Net zero: Our goal is to achieve net zero for all emissions.• Noise pollution: Our operations do not create noise, and construction-related noise is scheduled during waking hours.• Physical risk: Our areas are protected and secured from outside entry, and we require employees to use proper protection.• Waste: We minimize waste generation and ensure proper sorting and delivery for further utilization.• Water discharge/outflow: We reduce water consumption.• Water inflows/disposals: We reduce water consumption.
Procurement Policy and Procurement Handbook GOV-5 (Responsibility: Board of Directors)Investigation, monitoring, analysis, and assessment: business units Review: management team Reporting: Group Board of Directors Prepared: 2022 Amendment Update: 2024 Approved: Board Meeting 14.11.2023, reviewed annually if needed.PurposeIn this procurement policy, “procurement” refers to the purchase and leasing of goods and services (including leasing arrangements) from companies outside the Group. The procurement policy applies to all Loiste companies.Procurement ObjectivesResponsibility reporting must cover the entire value chain of the company’s operations. Through the value chain, the environmental, social, and governance-related risks and opportunities associated with the company’s operations are identified, assessed, and managed. The value chain includes all operations that contribute to creating a product or service, as well as the suppliers and other stakeholders of the company (from raw material procurement/product (service) design to delivery or production and eventual disposal). By analyzing the value chain, companies can identify areas where they can reduce their environmental impacts, improve employee working conditions, and enhance overall sustainability performance.Loiste companies engage in responsible collaboration with various partners and suppliers. Our supplier relationships are based on mutual contracts entered into by the contracting parties, the principles of Loiste’s responsibility program, and ethical rules. Supplier selection is based on our procurement policy, and in addition, we define in this procurement handbook the principles of collaboration, rules, and supplier evaluation methods (Loiste Companies_Procurement Policy). Contracts and operating models must specify the scope and content of operations. If a supplier fails to comply with contract terms or Loiste’s rules or causes harm to Loiste, the contract may be terminated. If contract terms are not up to date, they must be renegotiated and revised. The purchaser and invoice handler must follow Loiste’s purchasing guidelines and handling principles according to the value of the purchase (purchase and invoice approval instructions).We expect our suppliers to share our same set of responsible values. We demonstrate our responsibility by acknowledging and fulfilling the essential areas of our operations in accordance with the responsibility program (environmental, social, and governance).Suppliers are evaluated annually based on Loiste’s current supplier list.The goal is the safe, sustainable, reliable, and cost-effective procurement of products and services, taking into account their entire life cycle as well as the processes of the Group and its customers. Our procurement takes into consideration the Group’s existing guidelines, e.g., regarding sustainable development, infrastructure, information systems, counterparty risk, and reporting (CSRD/Corporate Sustainability Reporting Directive and ESRS/European Sustainability Reporting Standards). The procured item, product, or service must meet legal requirements. Our procurement processes consider responsibility from environmental, social, economic, and governance perspectives. We comply with the Special Sectors Procurement Act, adhere to good governance practices, and require the same from our partners. Risks related to procurement are assessed as part of business risk management. We require our partners and suppliers to commit to sustainable development and the principle of continuous improvement.Requirements for the availability of services must be taken into account in the procurement of services critical to security of supply.Wherever possible, the Group’s various units share, utilize, and jointly develop operating models, IT systems, processes, and best practices. Companies supplying services or products to Loiste, as well as the products and services themselves, are assessed during the bidding stage and supplier audits are carried out during the contractual relationship. The objectives for supplier evaluation and auditing stem from Loiste’s responsibility program and from requirements regarding products and services.Regular meetings are held with suppliers to review reportable matters, feedback, and development areas in accordance with the rules, considering environmental, social, and governance perspectives in line with the responsibility program.Procurement PrinciplesProcurement StrategyBusiness units determine a procurement strategy that best supports their business objectives at any given time, adhering to the procurement principles described in the procurement policy and procurement handbook.Competitive BiddingThe procurement competition is organized in the most appropriate way, based on the scope, value, quality, and market situation of the procurement.To ensure successful procurement, the necessary technical, legal, or other expert assistance is utilized. Responsibility for procurement and its success lies with business management.Active market dialogue ensures the development of the regional service market, helps schedule the tender process properly, and secures a sufficient supply for upcoming tenders.The competitive bidding process must be fair and non-discriminatory toward bidders, and the choice must be based on as objective selection criteria as possible. For individual procurements exceeding 10,000 euros, at least two bids must be requested if available. The chosen supplier must meet the requirements of Loiste companies’ Credit Risk Policy.PurchasingPurchasing primarily utilizes the existing framework agreement arrangement. Approvals are done according to Loiste’s governance model, following defined lines of responsibility and the so-called “four-eyes principle.” An exception is the urgent repair work ordered under a framework agreement, including parts, in accordance with Corporate Governance guidance. Expense invoices are checked by the purchaser and then approved by an individual with approval authority.Compliance with LegislationIn all our operations, we follow Loiste Group’s good governance and ethical rules, national legislation, regulatory requirements, and national and international agreements. We also require this of our suppliers. Procurement must not involve bribery on the part of either the buyer or supplier, nor such hospitality or gifts that could influence decision-making.District heating and electricity network businesses are covered by the Special Sectors Procurement Act.ContractsParticular care must be taken when drafting contracts to ensure that Loiste’s interests are protected even in cases of discontinuity or conflict. Comprehensive contracts and accompanying documents ensure a mutual understanding between the parties about the responsibilities and obligations related to the procurement.Any disputes between the parties are settled in accordance with Corporate Governance guidelines.Payment installments must be in balance with the performance received. In long-term procurements and deliveries under Corporate Governance guidelines, the supplier is required to provide a performance bond for the work period and warranty period. The supplier must provide a warranty bond for the warranty period of the delivery. In deliveries with multiple payment installments, ownership rights to the partial performance must preferably be transferred to the client.The procurement contract must include adequate insurance coverage that covers all general and product liability risks. Upon request, the supplier must provide the Buyer with the relevant insurance certificates.The payment term used in contracts is defined in more detailed procurement instructions.Contracts must be made in writing. The contract must always include the terms of delivery. The scope of the matter to be agreed upon determines the type of contract package used. With a supplier, one of the following may be drawn up:1. Framework Agreement a. Framework Agreement b. Delivery Agreement c. Service Agreement d. General Terms and Conditions e. Special Terms and Conditions f. Other contractual appendices2. Procurement Agreement3. Delivery Agreement4. Loiste General Terms of DeliveryContracts are reviewed, and legal services may be utilized in this review. Larger contracts are usually reviewed by attorneys. Particular care must be taken when drafting contracts to ensure that Loiste’s interests are protected even in cases of discontinuity or conflict. Comprehensive contracts and accompanying documents ensure a mutual understanding between the parties about the responsibilities and obligations related to the procurement.Any disputes between the parties are primarily settled in District Court. If the contract value is high, arbitration may also be used.Payment installments must be in balance with the performance received. For the warranty period of the delivery, the supplier must provide a warranty bond. In deliveries with multiple payment installments, ownership rights to the partial performance must preferably be transferred to the client.The procurement contract must include adequate insurance coverage that covers all general and product liability risks. Upon request, the supplier must provide the Buyer with the relevant insurance certificates.Unless otherwise agreed upon for compelling reasons, the payment term under the contracts is 30 days net.Supplier Evaluation CriteriaTo ensure the quality, efficiency, and responsibility of its operations, Loiste has set criteria for its suppliers at both the company level and the service or product level. We have established criteria for our suppliers, which are monitored and measured during the selection phase and throughout the contractual relationship.We annually examine the responsibility of our suppliers and carry out supplier evaluations. We conduct a more extensive supplier evaluation for those whose impact on our business is significant or whose operations present risks concerning environmental management or other aspects of responsible business.Loiste is committed to identifying the responsibility impacts of its value chain and reporting them as part of its responsibility reporting. Suppliers are part of our value chain, and we need information about them and the impact of their operations.Loiste and all parties involved in Loiste’s operations show their commitment to fulfilling the responsibility requirements regarding environmental, social, and governance issues throughout their entire value chain.Loiste companies require that companies providing services to Loiste report information concerning responsibility, good governance, operational quality, product and service compliance, environmental impacts and OHS, respect for human rights, anti-corruption, and anti-bribery to Loiste during the supplier selection phase and throughout the contract period as part of supplier evaluations.To ensure suppliers and their products and services meet the criteria, Loiste conducts supplier audits. Suppliers are required to cooperate and be transparent during audits.These operating instructions set general requirements for suppliers regarding their responsibilities in conducting business responsibly. The supplier pledges to operate responsibly and meet the requirements in its activities.“Our goal is to be carbon neutral by the end of 2026 in our own operations, and we are committed to supporting Finland’s transition to carbon neutrality by 2035.We also expect concrete actions from our partners to support Loiste in achieving our goal.We are committed to strong preventive work to avoid environmental risks in our operations.We participate in social projects where we can have an influence and use our expertise for the benefit of the climate.”Defining the Value ChainResponsibility reporting must cover the entire value chain of the company’s operations. Through the value chain, the environmental, social, and governance-related risks and opportunities associated with the company’s operations are identified, assessed, and managed. The value chain includes all activities contributing to creating a product or service, and the suppliers and other stakeholders of the company (from raw material procurement/product (service) design to delivery or production and eventually disposal). By analyzing the value chain, companies can identify areas where they can reduce their environmental impact, improve working conditions, and enhance overall sustainability performance.Management Responsibilities and CommitmentThe supplier must comply with all applicable legislation and any permit requirements relevant to its operations.The supplier must identify, take into account, fulfill, and demonstrate compliance with Loiste’s supplier requirements. At the contract stage, the supplier commits to Loiste’s specified criteria and to demonstrating compliance with them.Supplier ManagementSystematic supplier management ensures the principle of continuous improvement and secures the best overall solution for each procurement. Business units are responsible for classifying their suppliers in accordance with the principles of supplier management described in the procurement handbook. For suppliers with framework or annual contracts, or from whom purchases are made repeatedly each year, a supplier list is maintained in the financial system.Criteria for Supplier CompaniesAs part of supplier management, suppliers are evaluated during the bidding stage and the contractual relationship. The criteria for evaluation and auditing stem from the needs of responsible business units, contract compliance, and Loiste’s responsibility program.The supplier must comply with all applicable legislation and any permit requirements relevant to its operations.The supplier must identify, take into account, fulfill, and demonstrate compliance with Loiste’s supplier requirements. At the contract stage, the supplier commits to Loiste’s specified criteria and to demonstrating compliance with them.Finance and FundingCredit rating and the supplier’s financial condition- The supplier must be financially stable.- If necessary, we require collateral.Compliance with the Contractor’s Obligations ActNo older than three (3) months, the following documents and statements:- A statement indicating whether the company is registered in the prepayment register, employer register, and the VAT register in accordance with the Prepayment Act (1118/1996) and the Value Added Tax Act (1501/1993).- An extract from the Trade Register.- A statement indicating that the company has no tax debt as referred to in Section 20 b, Paragraph 1, Subsection 2 of the Act on the Publicity and Confidentiality of Tax Information (1346/1999) or a statement from the authority on the amount of tax debt.- Certificates confirming that employees’ pension insurance premiums have been taken out and paid, or evidence of an agreement for paying overdue pension insurance premiums.- A statement on the applicable collective labor agreement or the essential employment terms.- A statement on the arrangement of occupational health care.- A certificate of insurance under the Workers’ Compensation and Occupational Diseases Act.- In the construction sector, proof of mandatory accident insurance arrangements.- Documents must also verify that none of the company’s responsible persons are subject to a business prohibition. No contract may be entered into with a party whose legally required disclosures reveal that a responsible individual is subject to a business prohibition.Management Model and Good Governance- We require the supplier to disclose information on its management systems, how compliance is ensured across the value chain, and any certifications or audits conducted by third parties.- Loiste ensures that fair operating principles are followed in suppliers’ processes: transparency, ethics, and anti-corruption measures.Supplier and Subcontractor Management and Ensuring Responsibility- We require the supplier to demonstrate how it manages its supply chain and subcontracting chain, and how it ensures responsibility in its value chain.- We need information on how the supplier carries out public responsibility reporting.EU Taxonomy RequirementsLoiste is committed in its own operations to improving the following environmental aspects:- Climate change mitigation- Adaptation to climate change- Protection of water (and marine) resources- Promoting the circular economy- Preventing environmental pollution- Protecting ecosystems and biodiversity.- We require information from our suppliers on how they address these aspects within their value chains and ensure positive progress.- We require the supplier to commit to providing Loiste, upon request, with proof of compliance with environmental legislation and permits.- We investigate whether our suppliers’ operations are covered by the EU taxonomy and whether they meet the EU taxonomy requirements.The taxonomy promotes the following objectives:1. Climate change mitigation2. Adaptation to climate change3. Protection of water (and marine) resources4. Promoting the circular economy5. Preventing environmental pollution6. Protecting ecosystems and biodiversity.Loiste demonstrates its EU taxonomy compliance through fulfilling technical screening criteria and minimum safeguards. Suppliers commit to providing necessary information related to demonstrating Loiste’s taxonomy compliance.Here is a link to the technical screening criteria.1. Case-specific technical screening criteria for Loiste’s business2. Minimum safeguard measures: - Fair competition - Taxation - Anti-corruption - Human rights, incl. labor rights and consumer protectionWe require the supplier to commit to providing Loiste with documentation on compliance with environmental legislation and permits.Compliance of Products and ComponentsOur suppliers and their products and services must meet our performance and operational requirements. Key requirements must be set out in the procurement documents and contracts related to the procurement. These requirements generally follow standard practices, guidelines, and principles used in the industry.- We require that products and components meet their specified requirements. Compliance must be demonstrated through documents such as a CE mark, DoP (Declaration of Performance for construction products), DoC (Declaration of Conformity for machinery and electrical equipment).- For construction products, the requirement in line with the hEN standard must be identified (standards available: hEN Helpdesk for harmonized product standards).- If no hEN standard is available for a construction product, compliance must be demonstrated via a type approval certificate or site-specific acceptance showing the performance requirements, along with documentation confirming compliance and performance.- Possible Environmental Product Declarations (EPD) or Climate Declarations and material declarations- Energy efficiency data according to product-specific requirements- The relevant directives and standards applying to the product must be specified.- The supplier must provide appropriate operating, maintenance, and installation instructions.- SF6 gas is replaced by other chemicals.Compliance of Services- For services, the supplier must fulfill the quality of service described by Loiste, measured according to the SLA definition.- Services must comply with the relevant legislation.During Delivery, the Supplier Must:- Report greenhouse gas emissions (CO2 equivalent) from operations or products allocated to the client company in terms of quantity, not in euros.- Greenhouse gas (CO2e) calculations must meet the GHG Protocol, and the supplier may be required to provide documentation on calculation methods.- Report required occupational health and safety (OHS) data related to activities for the client company.- Provide waste reporting to the client company regarding waste generated in activities relevant to the client company.WasteWe require the supplier to prevent environmental pollution and ensure proper waste management.Work Practices in the Value ChainWe require the supplier to ensure/verify the following work practices throughout its value chain:1. Fair wages2. Working conditions3. Working hours4. Employment benefits5. Compliance with labor lawsHuman Rights and Working ConditionsThe supplier must ensure respect for all internationally recognized human rights within its value chain and avoid causing or contributing to human rights violations.Employee Well-being and Occupational Safety in the Value ChainWe require the supplier to look after employee well-being and occupational health.Diversity and Inclusion in the Value ChainWe require the supplier to prevent discrimination and ensure diversity and equal treatment in all circumstances.Stakeholder Engagement in the Value ChainWe require that cooperation with various stakeholders in all value chains be conducted responsibly, openly, and equitably.Data Protection, Information Security, and CybersecurityWe require our suppliers to comply with the guidelines of the Cybersecurity Center, data protection regulations and authorities’ directives, as well as the data protection and information security guidelines provided by the client, including cybersecurity and physical information security guidance.- We require the supplier to manage and be responsible for information security, training, and data protection.- We require appropriate handling of data and personal data in compliance with the law.Environmental and Social Responsibility, and Social ResponsibilityWe require our suppliers to comply with national and international environmental laws and regulatory requirements, and to operate in an environmentally and socially responsible manner. Where necessary, we provide instructions in contracts or other guidelines regarding environmental and energy efficiency requirements (e.g., energy efficiency labeling or certification). Environmental requirements are derived from legislation guiding the client’s operations and the client’s environmental and energy policy.Safety IssuesContractors, service providers, and their subcontractors working on company premises or worksites must, in addition to general occupational safety laws and regulations, comply with the Group’s occupational safety guidelines and instructions. Security clearances and possible substance and drug tests for supplier personnel must be enabled if the nature of the service requires it. These requirements must be documented in the procurement contracts.ConfidentialityWe require suppliers to sign a non-disclosure agreement if the task requires or permits access to confidential orders, contracts, and all related documents and information. Contracts must ensure that suppliers also require their subcontractors to commit to equivalent confidentiality obligations.PaymentPayment must be made in accordance with the contract. Under no circumstances is payment made in cash. It is made against an invoice, usually submitted retroactively. The purchaser and the person approving the invoice must be different individuals. Payment is made to the official bank account of the company.Supplier SelectionProcurement is generally based on bids received in response to requests for proposals. When entering into a contract, we utilize legal expertise in proportion to the contract risks. Procurement contracts are stored in the contract database.The arrangement and scope of competitive bidding is determined based on the significance of the procurement, in compliance with legislation.The supplier’s compliance with the Contractor’s Obligations Act, creditworthiness, and any necessary financial details are verified before selecting a new significant supplier. If necessary, the supplier is required to provide a performance bond for the work and warranty periods. During the procurement phase, it is verified that the supplier is not directly or indirectly on a sanctions list or disqualified. (In new contracts since 9.4.2022, and in older contracts the continued implementation was prohibited on 10.10.2022 (https://eur-lex.europa.eu/legal-content/FI/TXT/PDF/?uri=CELEX:32022D0578&from=FI))Documentation of Procurement DocumentsProcurement contracts and their appendices must be archived in Loiste’s database.All documents and appendices must be held by Loiste companies, following the documentation retention:1. We store the bid and contract documentation: - Requests for Proposals - Contracts, request for proposals, and decisions We store the materials related to service management and delivery in Service Management Memos according to process descriptions. - Feedback, observations, and development follow-up via the Ceriffi Check channel - Supplier evaluation and audit via the Ceriffi Check channelProcurement Handbook: Other Notable PracticesSupplier management and procurement must also take into account responsible operating instructions provided by authorities. There is a governance model for managing long-term supplier relationships. To enable feedback management, Ceriffi Check links can be distributed to suppliers.Conflict of InterestIf a Loiste employee is involved in selecting a supplier and has personal interests, the employee must inform his/her supervisor in advance. After a contract has been signed with a partner, a Loiste employee must not request private services from that supplier unless specifically approved by the supervisor.Additional Factors in Supplier SelectionWhen choosing a supplier, attention is paid to how well the overall solution meets the needs of Loiste companies. Selection criteria include, among others, the company’s expertise, reliability, responsibility, resources, and price of delivery.The supplier’s creditworthiness and any necessary financial details are verified before selecting a new supplier. If necessary, the supplier is required to provide a performance bond for the work and warranty period.During the bidding stage, a list of required information is provided to the supplier so that bids can be compared, and compliance with requirements can be verified.To ensure the quality, efficiency, and responsibility of its operations, Loiste has set criteria for its suppliers at both the company level and the service/product level. We have established criteria for our suppliers, which are monitored and measured during the selection phase and throughout the contractual relationship.The Loiste Group strives to achieve carbon neutrality across its entire value chain by 2026. We also expect carbon neutrality from our suppliers. We communicate our requirements already at the competition stage.Supplier guidance and product/service criteria ensure compliance of products, components, and services with Loiste’s requirements and legislative requirements. Practical implementation is documented at the project/process level.We annually examine the responsibility of our suppliers and carry out supplier evaluations. We conduct a more extensive supplier evaluation for those whose impact on our business is significant, or whose operations involve environmental risks or other risks regarding responsible business.Loiste is committed to identifying the responsibility impacts of its value chain and reporting them as part of its responsibility reporting. Suppliers are part of our value chain, and we need information about them and the impact of their operations.Loiste and all parties involved in Loiste’s operations show their commitment to fulfilling the responsibility requirements concerning environmental, social, and governance issues throughout their entire value chain.Loiste companies require that companies providing services to Loiste report information related to responsibility, good governance, operational quality, product and service compliance, environmental impacts and OHS, respect for human rights, prevention of corruption and bribery, during the supplier selection phase and throughout the contract period as part of supplier evaluations.To ensure suppliers and their products and services meet the criteria, Loiste conducts supplier audits. Suppliers are required to cooperate and be transparent during audits.These operating instructions set general requirements for suppliers regarding their responsibilities in conducting business responsibly. The supplier affirms that it operates responsibly and meets these requirements in its activities.Purchase TermsGeneralThis handbook applies to all Loiste companies’ orders and purchases from suppliers. No deviating terms apply unless approved electronically or in writing by the purchaser.The handbook applies to all contracts in the following order:- Contract document- Appendices to the contract document, excluding general and special terms- Applicable special terms- Applicable general terms and conditions- Requirements in this handbook- Other termsIf the documents are contradictory in content, the contract takes precedence, followed by the other documents in the order of precedence mentioned above.Quotation, Order, and ChangesTo be valid, all orders must be made electronically or in writing. Any change, correction, or addition to the order becomes part of the order only if both parties approve it electronically or in writing. The contract must include a provision that a binding contract between the contracting parties is formed only once all parties have signed the agreement or once the order has otherwise been placed.Delivery Time and DelayIf delivery is delayed due to reasons attributable to the Supplier, the Supplier is obligated to pay a contract penalty in the amount specified during the contract stage. Payment of the contract penalty does not limit the purchaser’s right to claim damages under the law.If the delivery is significantly delayed beyond the agreed delivery date, the purchaser has the right to cancel the contract in whole or in part at its discretion and seek damages.
Update: 2022Review: 20241 Introduction1.1 Loiste Group’s Credit Risk PolicyLoiste Group’s Credit Risk Policy is part of Loiste Group’s responsibility program and policy, and it regulates counterparty risk activities and related risk management measures.The Credit Risk Policy must be followed in all subsidiaries and business units managed by Loiste. The purpose of this policy is to provide stringent guidelines that meet the requirements of credit and counterparty risk management and to support each business unit in achieving its targeted business results despite prevailing counterparty risk.Loiste Group’s Finance function assesses each individual counterparty’s creditworthiness throughout the Group, utilizing external credit rating agencies as needed.1.2 Objectives and Scope of the Credit Risk PolicyThe objective of Loiste’s Credit Risk Policy is to enable Loiste’s financial objectives while managing counterparty risks. As Loiste’s operating environment evolves, the Group’s credit risk management must control overall credit risk in all business decisions and ensure that any potential impacts on profits are quantitatively measured and remain within defined limits.All Loiste personnel must comply with the Credit Risk Policy. The Board of Directors of Loiste monitors compliance with this requirement.The purpose of the Credit Risk Policy is:• To define credit risk and situations in which credit risk materializes, using metrics• To define key risk management and governance processes• To set risk mandates and counterparty limitsAll Loiste employees who interact with customers, sellers, and trading counterparties must comply with the Credit Risk Policy as well as all applicable laws, rules, and regulations. Employees must not disclose confidential business or operational information to other employees or third parties without the authorization of an appropriate supervisor.An essential part of the risk management framework is the approval processes, document archiving, and the outcomes of the risk management process. As a general principle, the credit approval process must be completed before any acceptable business transaction. No contractual activity is allowed without completion of Know-Your-Customer (KYC) and a creditworthiness assessment (see Section 6, Know Your Customer (KYC)).Counterparties are always first asked to fill out KYC data and go through Loiste Group’s creditworthiness process to determine counterparty rating, pricing, and a counterparty-specific credit limit.1.3 Validity, Responsibilities, and Approval Process of the Credit Risk PolicyLoiste’s Board of Directors approves the Credit Risk Policy. The Board also processes and approves changes to the main part of the Credit Risk Policy.This version of the Loiste Group Credit Risk Policy fully replaces the previously approved version of Loiste Group’s Credit Risk Policy.Loiste Group’s credit policy comprises the following roles and responsibilities:1.3.1 Loiste Board of Directors• Approves Loiste Group’s Credit Policy• Approves changes to the Credit Risk Policy1.3.2 Loiste CEO• Presents Loiste Group’s Credit Policy to Loiste’s Board for approval• Ensures that Loiste Group’s Credit Policy and limits are observed within the company• Approves counterparty credit risk in larger sales or procurement contracts upon signing, as per Section 4, within the credit limits approved by Loiste Oy’s Board1.3.3 Loiste CFO• Is responsible for creating, maintaining, and revising the Credit Risk Policy as needed, as well as for presenting any changes to the CEO and ultimately to the Board for final approval• Guides and develops the Group’s credit risk management process (described in Chapter 3)• Is responsible for and oversees the establishment of creditworthiness criteria• Approves counterparty credit risk for larger sales or procurement contracts, as per Section 4, within the credit limits approved by Loiste Oy’s Board• Is responsible for monitoring Loiste Group’s consolidated credit risk position, counterparty credit risk positions, compliance with counterparty limits, and credit losses1.3.4 Group Treasury• Evaluates the individual counterparty’s creditworthiness, credit pricing for the counterparty, and the maximum credit limit for the counterparty• Approves counterparty credit risk as per Section 4, within the credit limits approved by Loiste Oy’s Board• Manages collateral handling related to energy billing together with Ropo and gives Ropo authority to decide on a guarantee or collateral if the customer is deemed creditworthy1.3.5 Business Units• Are responsible for identifying their existing or potential counterparty before entering into a business relationship or contract• Provide the company name and contact details to Group Treasury so that creditworthiness and the counterparty credit limit can be verified – before finalizing a contract• Request that the new customer/supplier complete the KYC questionnaire (Section 6, Know Your Customer (KYC)) – capturing the required creditworthiness details (e.g., annual reports) for Group Treasury, and ask Group Treasury to carry out the creditworthiness assessment process to evaluate the counterparty’s credit profile and pricing (proposed credit and credit limit)• Determine the counterparty’s credit risk in cooperation with Group Treasury2 Credit Risk Management ProcessAll credit limit decisions are requested/prepared at the unit level in cooperation with Group Treasury. The business unit submits a request to Group Treasury/Finance Department and applies for credit limits based on the needs of the business units and the counterparty’s creditworthiness. Group Treasury/Treasury proposes a credit limit based on business demand and the counterparty’s creditworthiness. The credit limit decision is made according to the approval chain and Section 4, under the mandates granted by Loiste Oy’s Board, within the defined authorizations.2.1 Requesting a Group-Wide Limit for a CounterpartyNo contractual obligation of any kind may be entered into before first assessing the risk arising from the business in question and ensuring that the counterparty’s creditworthiness and financial strength are sufficient. The counterparty’s creditworthiness must also be reviewed when renewing or extending an existing contract and periodically during the contract term.The level of credit risk is limited by imposing a specific group-wide credit limit on the counterparty. Credit limits are set based on the potential credit risk posed by the existing or potential business relationship from the Loiste Group’s perspective, taking into account the counterparty’s creditworthiness and financial strength.A “limit” refers to the approved maximum total credit risk for an individual counterparty across all entities consolidated into Loiste Group. When assessing a counterparty’s credit risk, one must also consider operational disruption risk and any additional costs that might result from switching to a different supplier. In particular, counterparty risk posed by certain banks or trading counterparties with a low credit rating must be identified and managed carefully.If the creditworthiness criteria are not met, Group Treasury/Finance decides whether the counterparty’s creditworthiness is adequate. If the counterparty is newly established, has no credit rating, and no historical data is available, then after a credit review, a standard payment term may be offered. If the customer fails to pay, the counterparty must pay in cash upfront or provide guarantees to continue business operations.2.2 Assessing the Counterparty’s CreditworthinessThe purpose of credit risk management is to minimize all potential negative effects associated with counterparty creditworthiness issues. Loiste’s credit risk management is administered by Group Treasury/Finance, which conducts the following core activities:• Evaluates credit risk based on creditworthiness criteria (Section 5, Credit Criteria)• Establishes appropriate limits for each counterparty based on the rating or company assessment• Manages centralized collateral through Ropo operationsBusiness units are responsible for identifying an existing or potential counterparty before concluding a contract. Standard contract models should always be used. Group Treasury/Treasury confirms payment and invoicing terms as well as exit clauses for situations where the customer violates the contractual terms.The counterparty must be identified by using a Business ID, which must be verified to identify the counterparty. To assess group-level counterparty risk, the final parent company of the counterparty must also be checked.The representative of the business unit and the Group Finance department assess the counterparty’s credit risk. The credit risk must cover the entire term of the contract. Group Treasury/Treasury determines the final credit limit for the counterparty according to the mandates of the Credit Risk Policy. If the customer is not considered creditworthy, credit can only be granted if supported by a parent company guarantee (if the parent company is deemed creditworthy), a bank guarantee, collateral, or prepayment. Group Treasury/Treasury manages and decides on acceptable guarantees or collateral. A parent company or bank guarantee, collateral, or pledged funds must be arranged before entering into contractual obligations.The creditworthiness assessment must be carried out with reasonable credit checks using external data (e.g., credit rating agencies and available company/financial information, as well as prior experiences with the counterparty at Loiste). All relevant information that may affect credit decisions must be taken into account.2.3 Monitoring Counterparty Creditworthiness and Collateral ManagementA counterparty’s rating status may change. Group Treasury/Treasury may request, when necessary, a credit check from the service provider. This monitoring is carried out by collecting updates directly from the credit institution and from payment behavior data.When the existing counterparty’s creditworthiness deteriorates to an unreasonable level in terms of energy billing, or when the counterparty does not meet its invoice payment obligations, Ropo Collection demands collateral. Accepted collateral types include deposits or approved bank guarantees (instructions in Section 7, Collateral).Group Treasury/Treasury acts immediately when a limit is exceeded. Possible measures, depending on the situation, may include switching the customer to a prepayment arrangement (if the counterparty cannot pay its outstanding debt to an acceptable level), securing collateral, parent company guarantees, halting deliveries, or increasing the limit if the credit evaluation indicates it is justified.2.4 CollectionGroup Treasury/Finance is responsible for an effective process covering accounts receivable, payment, and collections, in collaboration with Ropo’s collection function. If a counterparty fails to pay its debts, Ropo Collection initiates a prepayment procedure or a delivery shutdown.Private Customers’ Consumption Bill, Final Bill, or Service• The first reminder is sent after the due date of the first invoice. The first reminder has a 10-day payment period.• If the customer does not pay, the first payment request is sent promptly, with a 10-day payment period as well.• If the customer still does not pay, a second payment request is sent promptly, with a 10-day payment period.• If the customer does not pay within this time, the first disconnection warning is issued, with a 14-day payment period.• If the customer does not pay, Loiste simultaneously cuts off supply, and a disconnection request is sent to the distribution company. The receivable goes to recovery.• If the debt is more than 180 days overdue, it is written off.Corporate Customers’ Consumption Bill, Final Bill, or Service• The first reminder is sent after the due date of the first invoice. The first reminder has a 7-day payment period.• If the customer does not pay, the first payment request is sent promptly, again with a 7-day payment period.• If the customer does not pay, a second request is issued promptly, with a 7-day payment period.• If the customer does not pay within this time, the disconnection process is initiated, and the first disconnection warning is sent, giving a 14-day payment period.• If the customer does not pay, Loiste simultaneously cuts off supply, and a disconnection request is sent to the distribution company. The receivable goes to recovery.• If the debt is more than 180 days overdue, it is written off.Connection Bill: Private and Corporate Customers• The first reminder is sent after the due date of the first invoice. The first reminder has 10/7 days of payment time.• If the customer does not pay within this time, a worksite connection termination notice is sent with a 14-day payment period.• If the customer does not pay within this time, worksite connection termination may begin, and the receivable goes to the collection process.Collateral Bills: Private and Corporate Customers• If the customer does not pay the first bill on time, a disconnection request is immediately sent to the distribution company.3 Credit Risk ReportingRopo regularly reports on the credit risks and overdue payments of all Loiste Group’s energy billing counterparties to the Group Treasury/Finance department. The report must include a status update on the current delay situation, any changes in the customer’s creditworthiness, and ongoing measures.4 Credit Limits Approved by Loiste Oy’s BoardIf the counterparty does not meet the creditworthiness requirements, a tailored solution may be created in which Loiste Group’s interest charges fully cover certain aspects (e.g., partial advance payments or special rules for construction firms). In these cases, the CEO has special authorization to decide.Mandate Request Made By Approved BySize (total) PeriodCredit Risk < EUR 100,000 Annual/repetitive Business unit RopoCredit Risk < EUR 1 million Annual/repetitive Business unit CFOCredit Risk < EUR 5 million Annual/repetitive Business unit Group CEOCredit Risk > EUR 5 million Annual/repetitive Business unit BoardCredit Risk < EUR 1 million Entire liability & contract maturity Business unit CFOCredit Risk < EUR 5 million Entire liability & contract maturity Business unit Group CEOCredit Risk > EUR 5 million Entire liability & contract maturity Business unit Board5 Credit CriteriaCreditworthiness is monitored based on the counterparty’s payment behavior and a third-party binary credit rating, such as from Intrum, Bisnode, Dun & Bradstreet, or equivalent. Either the customer is regarded as creditworthy or not creditworthy.• Creditworthy: Standard billing terms apply by default. Creditworthiness is monitored in the payment and collection process.• Not creditworthy: Cash or prepayment is required.6 Know Your Customer (KYC)1. Basic Details of the Customer Company• Company name• Business ID• VAT number• Country of establishment• Contact person2. Mandatory Inputs for a Creditworthiness Check• Excerpt from the Trade Register• The latest audited financial statements3. Details of the Customer Company’s Ownership and Group Structurea. Ultimate owner of the parent company4. Loiste Group Finance/Treasury Limit Decision• Creditworthy or not• Rating• Group-wide credit limit for the counterparty7 CollateralRequesting collateral is related to Loiste’s Credit Policy and is always the primary option. The Credit Policy allows for situational discretion, and the operational guidelines include clarifications for the most common scenarios.Credit checks are performed via Suomen Asiakastieto’s services. There must be a valid reason for checking a consumer customer’s credit (i.e., establishing a contract (= granting credit) or checking creditworthiness after payment defaults). All queries are logged in Suomen Asiakastieto’s register, and the person conducting the check is personally responsible for the appropriateness of the query. When notification of a contract arrives via Datahub, the system automatically checks credit data.7.2 Collateral for a Consumer CustomerA private customer’s credit is checked when entering into a contract, changing contract types, moving to a new location, or if payment defaults arise during the contract term.Collateral may also be required if the individual has no personal ID number when making the contract or refuses to provide it. The collateral covers the value of four months’ electricity bills in euros. The person’s credit rating indicates the severity of the payment default and suggests the recommended credit decision.If the customer has payment default entries in their credit history when making the contract or significant payment defaults in previous electricity contracts, Loiste has the right to require collateral from the customer separately for both the sales contract and the distribution contract. Upon disconnection, before reconnection, the customer must also pay collateral.The collateral covers the amount of the invoices in euros for the time between when the invoice is issued and the disconnection date. For private customers, this means the euro amount of four months’ electricity bills, with a minimum of EUR 100. Collateral is always in cash and is linked to the specific customer and point of delivery.Collateral must be returned to the private customer one year after it is provided, if there have been no significant payment defaults during the period the collateral has been in effect. A significant payment default is defined as disconnection of electricity supply or the presence of unpaid overdue bills at the time of collateral return.7.3 Collateral for a Corporate CustomerThe credit data of a corporate customer is checked when entering into a contract or if there are reasons for requesting collateral during the term of the contract through payment monitoring. The grounds for requiring collateral include significant payment defaults during the contract term. A significant payment default is deemed to be a disconnection warning and multiple overdue bills simultaneously. For a corporate customer, the collateral covers the euro amount of three months of electricity bills.No credit checks are needed for housing companies, public entities (i.e. municipalities, regions, municipal and state enterprises), banks, insurance companies, Lutheran or Orthodox parishes. Collateral must be returned to a corporate customer after two years if there were no significant payment defaults during the collateral period. A significant payment default is disconnection of electricity supply or the presence of unpaid overdue bills at the time of collateral return.7.4 Operating Guidelines7.4.1. Checking and Recording the Credit RatingThe customer’s data is assigned the same credit rating as in Suomen Asiakastieto’s register, along with the check date.For private customers:MHL0 = no payment issuesMHL1 = no payment issues, but other remarks (e.g., appointment of a trustee)MHL2 = Reason for collateral: old payment default entriesMHL3 = Reason for collateral: payment default entries in credit history. This category is also used if there are serious payment defaults in Loiste’s contractsMHL4 = Reason for collateral: severe and numerous payment default entriesFor corporate customers, risk classes range from 1 to 5 (RL1–RL5).7.4.2. Requiring CollateralPrivate CustomersIf a new customer’s credit history contains records (MHL2–MHL4), we always require collateral.If the customer has previously had Loiste contracts and always paid on time, the collateral requirement may be waived in MHL2 and MHL3 categories. If the customer is MHL4 but has always maintained a good payment record with Loiste, collateral may be waived. This can apply, for example, when moving to a new address or changing contract types. In all these cases, credit data is checked regardless.If the customer is deceased and a new electricity contract is made for the surviving spouse, no collateral is required if the deceased customer’s bills were always paid on time. Credit data is still checked.Collateral should never come as a surprise to the customer, so the customer must always be contacted by phone before sending the collateral invoice.Corporate CustomersCollateral is required if an older company (over 4 years old) has a risk class of RL4 or RL5. A new company always poses a risk, and we handle this with a short payment term or collateral:• A new company (under 4 years old) with payment default records always requires collateral. The payment term is then 14 days.• If a new company has no payment default entries, an alternative 7-day payment term can be offered, or collateral is requested, which allows a 14-day payment term.• A contact person must be noted, indicating who agreed to the arrangement.If a stable, creditworthy payer stands behind the new company (and that payer’s creditworthiness is verified), collateral may be waived as a matter of discretion. Examples include situations where the electricity seller bills the distribution portion, or another reliable entity (like Kesko or similar) is the payer. There are also sectors where bankruptcy or insolvency is extremely rare, and these are considered separately on a case-by-case basis.If the company has maintained a good payment record with Loiste and is registering new points of delivery, collateral for the new point of delivery may be waived at the company’s discretion.Collateral must be returned to a corporate customer after two years if there were no significant payment defaults during the collateral period.Collateral Handling1. Collateral Amount and Collateral InvoiceThe collateral amount is calculated in a separate Excel spreadsheet. The volume of electricity usage and the contract type affect the collateral amount. The smallest collateral is EUR 100. An agreement on collateral and the collateral invoice are created in CX as agreed with the customer. When negotiating the collateral with the customer, they must be clearly informed that failing to pay the collateral does not cancel the contract but instead leads to interruption of electricity supply without further notice.2. Cutting Off Supply Due to Unpaid CollateralIf the customer does not provide the collateral by the due date, electricity supply is interrupted without further notice. In some cases, the collection department may request that customer service contact the customer regarding the unpaid collateral. According to the terms and conditions of electricity supply, this constitutes a breach of contract whereby the electricity contract can be terminated if not all contractual terms are fulfilled.3. Collateral ConfirmationOnce the collateral amount has been paid, a separate confirmation of receipt is sent to the customer.
The sustainability report is published on the company’s website. Internally, sustainability tracking is reported and communicated during meetings to our own personnel and stakeholders.PurposeThe purpose of communication is to promote and support the achievement of the companies’ objectives. This means creating, maintaining, and developing communication arrangements through which functional interactive relationships are formed within the Group and with other key stakeholders crucial to operations.Goals for CommunicationIn these companies, the goals for communication are proactivity, timeliness, correct content, and truthfulness. Proactivity means that communication is used systematically to achieve the Group’s objectives. Proactivity is closely related to the regularity of communication. It involves both sending and receiving messages: information is shared before others have the chance to do so, and, on the other hand, everyone wants to and knows how to seek out the information they need on their own initiative. Timeliness means that information is available when it is needed. It involves the speed of communication and ensuring that personnel are informed before other target groups.Correct content and truthfulness mean that communication does not contain errors or withhold essential information. This requires sharing negative news in addition to positive news. When communicating externally, it must also be clearly stated whose opinion or interpretation is being presented: the individual’s or the company’s.The communication principles apply to all communication within the Group: internal communication among personnel, communication between personnel and customers, and communication between personnel and other external stakeholders.Communication Target GroupsThe main target groups for the companies’ communication are:
Communication Responsibilities and Organization of Communication TasksThe CEOs of the Group companies are responsible for the companies’ communication. To manage communication, they have delegated part of their responsibilities within the organization so that each business unit director, as well as the head of the internal support and service process, is responsible for the content and implementation of communication in their own area of responsibility, within the framework created by common principles. In practice, everyone on the staff has some communication responsibilities and tasks.The principle is that the various business units, as well as the staff of support and service processes, manage their daily communication tasks independently. The Communications Manager is responsible for coordinating communication, developing communication arrangements, and carrying out shared Group communication tasks. The Communications Manager supports business management and staff in the practical implementation of communication.Financial InformationThe companies do not publish their own financial reports for external distribution. A financial statement bulletin is published on the parent company’s results after its release, posted on the intranet and public websites, and distributed to key financial and general media outlets.Responsibility for internal financial communication to the staff lies with the CEO and business unit directors. The companies’ financial statements are presented annually at the spring staff briefing. In addition, the companies’ financial status and performance are covered at the autumn staff briefing and at other times if necessary.Environmental InformationResponsibility for both internal and external communication related to environmental issues lies with each business unit director and support unit leader in their respective areas of responsibility. The ESG Controller is responsible for internal communication regarding the environmental management system and its development.The Communications Manager supports those responsible in the practical implementation of communication.Crisis CommunicationIn crisis situations, Loiste Oy’s business units follow their crisis plans, which also include guidelines for communication.
Reporting period