Supplier code of conduct

The Supplier must:

• Comply with all applicable laws and regulations.

Stora Enso is committed to fully follow all applicable legislation wherever we operate. But playing by the rules is not enough – we go beyond compliance whenever possible and always strive to be better. We encourage our suppliers to do the same.

Our SCoC outlines minimum standards for our suppliers that function as additional requirements to applicable laws and regulations. 

• Demonstrate its commitment to and compliance with the requirements of this SCoC or its own equivalent code of conduct, as well as all other relevant and applicable laws and regulations, through adequate management systems, policies and guidelines, effective risk management, trainings, and the allocation of sufficient resources. The measures should be appropriate to the size and nature of the Supplier’s operations.

Policies and guidelines present a company’s commitment to and ways of working on different topics.

Having a management system means that you have a framework or process to ensure that your organisation can fully achieve its objectives, improve its performance, and act according to laws and regulations. It is a description of how the organisation works: an organisation chart including roles and responsibilities; main processes and their links to each other; target setting; monitoring performance; key documents and instructions. A management system can be manually documented and maintained or supported with IT tools.

The quality and exact function of your management system depends on the nature and size of your operations. A complex, global operation with many employees and potential risks will require an advanced management system that is based on standards, such as ISO 9001, ISO 14001, ISO 45001, and/or SA 8000. A privately owned small enterprise will need a lighter approach.

Risk management means that you are aware of and mitigate the impacts and risks of your operations on, for example, safety, ethical business, the environment, and human rights. You should systematically and in a reasonable manner document assessments and mitigation plans that are regularly reviewed by the senior management of your company. Assigning responsibility to specific people for individual topics helps to ensure that sufficient resources are allocated to material topics and targets. 

• Ensure that its own suppliers and sub-suppliers comply with the requirements of this SCoC or their own equivalent codes of conduct and take full responsibility for the work of the sub-supplier.

Companies operate in a complex world among many different stakeholders with various interests. For Stora Enso, it is not enough to only manage our own operations; we also need to take into account surrounding communities, our business partners, non-governmental organisations, and other stakeholders.

We want all stakeholders in our supply chain to know about the requirements of our SCoC or our supplier’s own code of conduct. To do this, you should consider communicating the requirements of our SCoC, or those set in your own code of conduct, to your supply chain and explaining why it is important to comply with them. You can also encourage your suppliers to learn more about your code of conduct and/or Stora Enso’s SCoC.

Monitoring your own suppliers and sub-suppliers, for example through contractual sustainability requirements, on-site audits, or site visits, will help you ensure that the services or materials you provide to us, and the materials you use to manufacture components, parts, or products, are sourced from environmentally and socially responsible sources. Materials and services that either directly or indirectly contribute to conflicts are unacceptable. Conducting due diligence in your sourcing operations will help you identify risks and inform the way you choose to monitor your suppliers and sub-suppliers.

As relevant, you must exercise due diligence regarding the source and chain of custody of the materials and services you provide/use and make any due diligence measures available upon request.

• Ensure that its employees, its sub-suppliers, local communities, and other relevant stakeholders have access to grievance channels to anonymously voice their concerns about potential misconduct related to the requirements of this SCoC. The Supplier must also have processes in place to address these concerns and remedy any confirmed cases.

This means that all of your employees (permanent, temporary, or contracted) and the employees of your relevant business partners must have an opportunity to formally report work-related grievances and any breaches against your policies or Strora Enso’s Supplier Code of Conduct. Such processes should preferably be anonymous and, in all cases, without fear of retaliation. Also, they must be in accordance with all relevant and applicable legal requirements.

Confidential and anonymous grievance channels may vary from sophisticated internet-based channels to a more simple mail box. The most important thing is that all employees should be aware of their opportunity to report concerns. In case of grievances related to Stora Enso, we expect you to report these to us promptly so that we can initiate necessary actions.

In cases where potential misconduct related is confirmed, remedial mechanisms and corrective actions need to be in place for prompt implementation. If necessary, external organisations may be brought in to help implement and monitor such measures.

You must respect the privacy of all employees in accordance with applicable privacy-related laws and regulations. We do not accept workplace monitoring or collection of employee personal data without the knowledge of employees. 

• Maintain transparent and accurate books and records to demonstrate compliance with the requirements of this SCoC and applicable laws and regulations. 

You should be able to provide evidence and documents that demonstrate how the requirements of our SCoC are taken into account in your operations.

We expect you to truthfully and accurately, as defined by applicable law, disclose information regarding your business activities, structure, financial situation, and performance in accordance with all applicable laws, regulations, and prevailing industry practices. For this purpose, you will need to maintain transparent and up-to-date financial records as well as records that enable you to demonstrate compliance with all applicable regulations. 

The Supplier must:

• Have zero tolerance for corruption in all its forms and never pay, accept, or mediate bribes, facilitation payments, or kickbacks.

Stora Enso has a zero tolerance approach to corruption anywhere in its operations and value chain. Corruption, in this context, includes offering, giving, receiving, or soliciting bribes, facilitation payments, and other means to obtain improper benefit or advantage, either directly by a company or by a third party for its benefit. 

• Avoid excessive business entertainment that could inappropriately affect the outcome of business decisions.
  
  
• Not pay for the travel or accommodation costs of Stora Enso Representatives when they are visiting the Supplier, nor offer them gifts, hospitality, or entertainment, except moderate catering in direct connection with business events.

Competing and doing business should be based only on quality and competence. Gifts, hospitality, or expense payments that are of unreasonably high value, or that could inappropriately affect business decisions – or even create this impression – should be avoided. Rebates, commissions, donations, and should be made transparently.

Stora Enso always pays for the travel and accommodation costs of its employees. There is no occasion where an organisation or person inviting our representatives would be allowed to pay any of these costs. We encourage all our stakeholders to do business in this same transparent manner, so as to support fair and open competition. 

• Without setting aside its legitimate business interest, prevent conflict of interest situations for the Supplier and its employees. Any such potential conflicts of interest shall be reported to Stora Enso.

A conflict of interest refers to situations in which personal interests, outside activities, external interests, or personal relationships may have an effect on your ability to fulfill your obligations. A conflict of interest could arise, for example, when you are involved in activities or contractual arrangements with other parties or have significant ownership and power in other companies, which could influence your decisions or work. This does not restrict your freedom to compete in the market, have contracts with other customers, and negotiate your business relationship with Stora Enso.

Working for companies other than Stora Enso is not a conflict of interest unless you have made a specific separate agreement that directly restricts your ability to act freely in your business relationship with us. Please inform us of any situation that could possibly be seen as resulting in a conflict of interest. 

• Never participate in money laundering or the financing of terrorist or criminal activities, and comply with applicable trade sanction programmes. This requires conducting careful due diligence before selecting a business partner.

Money laundering is the process through which an individual or organisation seeks to make the proceeds of criminal activity appear legitimate. Money laundering is also sometimes used to refer to the handling of any benefit that arises from acquisitive crimes, such as theft, fraud, or tax evasion. You should not knowingly engage in transactions that facilitate money laundering and terrorist financing or that otherwise result in the unlawful diversion of assets.

The international community, including the UN, the EU, and individual countries, impose a wide variety of trade sanction programmes against violators of internationally recognised human rights and principles of law. These sanction programmes are typically targeted at specific countries or territories; persons, entities, and/or organisations; as well as types of products and/or activities. Sanction programmes also prohibit activities that are intended to circumvent or evade the imposed restrictions.

Compliance with applicable sanction programmes is not only important for you or Stora Enso as a company, but also for individual employees. In some jurisdictions, breaches of sanction programmes may lead to criminal liability and the imposition of fines on individual employees in a personal capacity. 

• Compete fairly and in compliance with all applicable antitrust and competition laws by, for example, not agreeing on price fixing, output levels, market sharing, or customer allocations and not sharing competitively sensitive information.

Stora Enso is committed to free and open competition in markets. Supporting free and fair competition in the market works in our interest and benefits society at large.

All companies should be able to trade and compete as they wish, as long as they follow all applicable laws and regulations. This means, for example, never becoming involved in fixing prices in the sharing of confidential information between competitors, or in any other unfair or restrictive business practices. 

• Comply with relevant data privacy legislation and other related regulation.

Complying with and committing to applicable data privacy and localisation laws will ensure that the privacy of all individuals whose information is processed during and after a business relationship, including any eventual retention time, is maintained. It will help you to follow applicable best practices, official guidance, and Stora Enso’s instructions related to, for example, personal data handling principles, risk management, technical and organizational measures, and the use of subcontractors. Please always inform us of any breach of the privacy of any individuals related to our collaboration.

• Protect entrusted confidential and sensitive information with due care and ensure the cyber security of its operations by understanding risks and implementing sufficient controls.

Companies should know their cyber security risks and implement sufficient controls, such as multi-factor authentication, encryption, access controls, safe password practices, and regular security updates to mitigate the risks.

• Have an appropriate business continuity plan in order to mitigate the impacts of potential exposure to terrorism, crime, business threats, pandemics, natural disasters, and relevant major accidents.

Business continuity is the advance planning and preparation undertaken to ensure that a company will have the capability to operate its critical business functions during unexpected and emergency events. These types of events can include natural disasters, business crises, pandemics, workplace violence, major accidents, or any event that results in a disruption of your business operations. It is essential to plan and prepare not only for events that will stop operations completely but for those that also have the potential to adversely impact operations. A business continuity plan outlines procedures and instructions an organisation must follow in the face of such disasters. It covers topics, such as business processes, assets, human resources, and business partners.

• Act in compliance with all rules and regulations related to product safety as well as quality and due diligence requirements for all goods, such as equipment, articles, chemicals, and services delivered, including rules defined by Stora Enso when applicable.

Doing business responsibly also means complying with laws, regulations, standards, and policies related to the product safety, quality, and due diligence of all goods. Stora Enso has defined rules to ensure the safety of its operations to people and the environment. For example, when entering our premises or facilities, familiarise yourself with and adhere to the safety and environmental instructions of that site.

We require all our suppliers to deliver quality products and services that offer a high level of safety, reliability, and environmental performance. In particular, this applies to preventing, identifying, and correcting safety defects. For example, it is important that our suppliers maintain and update MSDS/SDS sheets for chemicals and receive such sheets from their own suppliers. We may ask for this information, or other relevant documentation related to chemicals, to ensure the safety of the chemicals used in our operations.

Conducting due diligence means that a company takes reasonable steps to avoid committing an offense or violation or breaching an agreement. Due diligence can include activities, such as investigations, audits, or document reviews.

The Supplier must:

• Comply with all applicable OHS and hygiene requirements defined by Stora Enso and ensure a safe and healthy working environment for its employees, visitors, and any sub-contractors working on its behalf. Any housing provided by the Supplier must be safe, comfortable, and healthy. 

We recommend that you have a written OHS policy in place, where your top management can communicate the importance of a healthy and safe workplace to all of your employees. Strong support from top management level is vital to the successful management of OHS topics, and managers should pro-actively demonstrate their commitment to health and safety through their own actions.

If employees are offered housing by the employer, it should fulfill all applicable health and safety regulations. Employees residing in employer-provided housing must, for example, have access to clean water and sanitation and to safe facilities for preparing meals.

• Assign responsibility for OHS issues within its organisation.

The responsibility for OHS issues should be clearly assigned to specific people in the organisation. All employees should know who has the overall responsibility of OHS and understand their own roles and responsibilities through regular training. 

• Take measures, including appropriate controls, work procedures, workplace inspections, emergency plans, and providing safety equipment, to prevent workplace hazards and accidents.

Suppliers are required to carry out Hazard Identification and Risk Assessments and to determining controls. Hazard Identification, Risk Assessment, and controls are the basic key elements of OHS management. Hazards must be identified and risks evaluated in all work areas and in all work types. The risk assessment must include all health and safety issues relevant to the work, including mechanical, biological, chemical, psycho-social, and ergonomics risks. The risk assessment must contain the evaluation/prioritisation of risk (e.g. impact x likelihood assessment) and corrective actions or measures to remove/mitigate/control the risk. As one example of OHS risk mitigation and controls, special attention has to be paid to controlling that appropriate Personal Protective Equipment (PPE) is available and used by its employees.

Employees must identify risks before starting work. Supervisors must follow up on all safety rules and procedures being adhered to in daily work. All work has to be planned beforehand to ensure that the work can be done is a safe way.

Companies need to ensure that OHS rules and procedures are followed in daily work and that the physical conditions are safe by carrying out regular safety inspections and audits. The audits are important because the audit results give systematic information on the areas of strengths and opportunities for improvement.

Your written and well communicated procedures should be designed to respond to emergencies, such as fires, explosions, chemical spills, natural disasters, medical emergencies, or any other emergency situation that might arise in your operations. You should have sufficient capacity to provide first aid as necessary, in the shape of readily available first aid equipment and suitably trained staff. It is essential to hold regular drills to practice emergency responses. Emergency procedures are needed to ensure that in any case of emergency everyone immediately knows what actions they need to take to control the situation as soon as possible and limit any damage.

• Monitor and keep records of its OHS performance and hazards, and report and investigate all OHS-related incidents.

Ways to monitor and keep records of your OHS performance and risks include:

• Evaluating the effectiveness of your OHS work with suitable metrics. Typical OHS metrics include statistics on Total Recordable Incidents (TRI) and Lost Time Accidents (LTA) rates; number and type of incidents (near-misses, accidents); and absenteeism or attendance rates.
• Properly recording and investigating all accidents and near-misses.
• Defining concrete corrective actions as soon as possible after an incident and following up on their implementation.
• Keeping detailed records on the number and nature of near misses and accidents to define the right measures for eliminating their root causes.

If you operate within Stora Enso’s sphere of responsibility, such as at our mills, in our harvesting operations, or logistics services, or at our tree planting sites – you should also report all accidents to Stora Enso.

• Ensure that its personnel have received appropriate OHS training, strive to increase its employees’ and sub-contractors' awareness of health and safety issues, and enhance safety culture through open communications. 

OHS rules and procedures will not be effective if your employees are not aware of them. Ways to ensure that your employees understand the importance and practicalities of OHS issues include:

• Offering regular training on relevant OHS issues to ensure that everyone knows the risks and the correct way to work safely, and to build a proactive safety culture.
• Raising awareness through regular communications.
• Engaging employees in the continuous improvement of OHS. Employees often have the best understanding of working methods and how to improve safety.
• Establishing a forum to exchange information between employees and management on issues including unsafe incidents, safe working methods, up-coming regulation, and/or training.

The Supplier must:

• Respect all human rights and conduct human rights due diligence to avoid and address potential adverse impacts.

We strongly recommend that our suppliers commit to the UN Guiding Principles on Business and Human Rights (UNGPs) and the International Labor Organization’s (ILO) fundamental conventions. According to the UNGPs, respecting human rights means that companies:

• Make a public commitment to respecting human rights.
• Take the right steps to identify their potential impacts on people and address them. This is called due diligence.
• Provide grievance channels for all stakeholders to speak up and report potential misconduct, including cases related to human rights. Companies must also be prepared to remedy – to make right – any confirmed cases.
• Communicate and report transparently on their performance.

Human rights should be respected across your operations and in your relationships with business partners and other stakeholders that might be impacted by your operations. This includes your own employees, those of your suppliers and business partners, as well as people in surrounding communities. Related requirements apply equally to all workers, including permanent and temporary employees, onsite contractors, and agency workers, as well as piece-rate, salaried, hourly paid, legal young workers (minors), part time, night, and migrant workers.

When a supplier and Stora Enso have separately agreed on such a process, the Supplier should submit systematically documented assessments of human rights related impacts to Stora Enso.

In addition to labour rights, it is important to take into account environmental and social impacts related to:

• Surrounding communities where people’s health, livelihoods, access to clean water, education, and cultural life could be affected.
• The acquisition, renting, and leasing of land or property without prior and informed consent or adequate compensation to affected people.
• The improper displacement or resettlement of communities, including indigenous people, ethnic minorities, and other vulnerable groups, to support a company’s activities. This includes adverse impacts resulting from the establishment, expansion, reduction, or termination of operations.
• The improper treatment of people working on-site or living in neighbouring communities by security personnel employed by or acting on behalf of a company.
• The use and disposal of products and services.
• The non-resolution of grievances related to a company’s operations.
• Access to clean toilet facilities, potable water, and hygienic food preparation and storage facilities. Any accommodation provided to employees must be clean and safe, offer reasonable personal space, and be fitted with adequate emergency exits, heating, and ventilation.

• Provide equal opportunities to all its employees and not discriminate against anyone based on ethnicity, gender, disabilities, sexual orientation, religious or political beliefs, or other such characteristics.
  
  
• Not allow any physical, psychological, verbal, or sexual harassment or abuse towards any employee.

Everyone has the right to feel safe, included, and respected at work. We have zero tolerance against discrimination and harassment of any kind and expect the same from our suppliers. Everyone should be treated equally regardless of ethnicity, gender, disabilities, sexual orientation, religious or political beliefs, or other such characteristics. Discrimination is not acceptable during any part of any employment relationship (hiring, compensation, benefits, advancement, discipline, termination, or any other employment practices). All individuals, regardless of their position within the organisation, must be treated with due respect (ILO Conventions 100 and 111 on Discrimination).

All forms of unfair and inhumane treatment of workers, including bullying, abuse or harassment, are equally unacceptable to Stora Enso.

• Not employ any workers below 15 years or the legal national minimum age, whichever is higher (in line with the ILO Convention 138 on child labour). If child labour is found, the Supplier must take action in the best interest of the child.

We do not accept any form of child labour anywhere along our supply chain. It is important to understand the risk of child labour in your own operations and among your suppliers and sub-suppliers, and to highlight that you completely condemn such practices. To ensure that no underage persons work in your operations (including your own employees and contracted workers), it helps to have robust age verification procedures and records in place.

If a child or underage person is found working in your operations or in your supply chain, you should inform Stora Enso immediately. Such cases should be handled together with experts to ensure that the actions taken are in the best interest of the child. This can mean, for example, that you help the child to attend and remain in school to ensure that they are not immediately employed by someone else. We also strongly recommend that you commit to the Children’s Rights and Business Principles.

• Ensure that employing young people above minimum age but under 18 years does not jeopardise their education, health, safety, or morals.

We support the use of legitimate workplace apprenticeship programmes that comply with all relevant laws and regulations. All young workers below the age of 18 but over the minimum age (as defined above) must be protected from performing any work that is likely to be hazardous; that interferes with their education; or that may be harmful to their health or physical, mental, social, spiritual, or moral development.

• Not use or benefit from any forms of involuntary labour or debt bondage, including not withhold passports or other documents of employees.

This requirement is to ensure that your activities respect ILO Conventions 29 and 105 on Forced and Compulsory Labour. All work, including overtime work, must be voluntary, and workers must be free to leave employment on reasonable notice.

Involuntary labour includes all forced, bonded, or indentured labour, human trafficking, and any other from of labour where the worker is not working by choice but instead, is in some way forced to do so. Human trafficking, for example, includes the transportation, harbouring, recruitment, transfer, or receipt of any persons by means of threat, force, coercion, abduction, fraud, or payments to any person having control over another person for the purpose of exploitation.

Ways to ensure that involuntary labour does not exist in your operations or supply chains:

• Workers are not required to surrender any government-issued identification, passports, or work permits as a condition of their employment. This also applies to third-party agencies providing workers.
• Any loans or salary advancements to employees are based on fair terms that are clearly explained to the employee.
• All documents relating to employment relationships are available to employees, and explained accurately in a language understood by the worker whenever possible.

• Follow ethical recruitment practices and ensure any recruitment agency working on behalf of Supplier does the same. Employees must have written contracts for employment and must not be charged any recruitment fees.

Human rights should always be respected in recruitment. In addition to the labour rights requirements that are included elsewhere in this SCoC, ethical recruitment can mean, for example, that:

• No recruitment fees or other fees are borne by the worker.
• There is no coercion to sign an employment contract.
• The employment contract is clear and understandable for the worker.
• The employee is free to end the employment and return home (in the case of migrant workers).
• There are no limitations to freedom of movement (fore example, withholding passports).

• Fully recognise employees’ right to organise, and to form and join (or not join) a union and bargain collectively. If (private) unions are not allowed, the Supplier must support other forms of employee representation.

These requirements are in line with ILO Conventions 87 and 98 on Freedom of Association and Collective Bargaining. Workers have the right to join (or not joint) or form trade unions of their own choosing, and to bargain collectively, without prior authorisation from management.

Ways to ensure that employees’ right to organize is respected:

• The employer does not obstruct or prevent such activities. When operating in an area where the right to freedom of association and collective bargaining is legally restricted or prohibited, the employer does not hinder any other forms of independent worker representation and negotiations.
• Worker representatives or trade union members are not penalised or discriminated against because of their links to a trade union or their legitimate trade union activity, in accordance with international labour standards.
• Worker representatives have access to the workplace in order to carry out their representative functions.

• Pay employees at least the national minimum wage while recognising the right of its employees to reasonable remuneration.
  
  
• Overtime must be compensated at a premium rate or as defined in national legislation. Wages and overtime compensation must be paid regularly and directly to the employee.

Employers should fully observe all laws and regulations relating to minimum wages, overtime wages, piece rates, and other elements of compensation including legally defined benefits (such as social insurance, parental leave benefits, and paid annual leave).

Steps you can take to offer reasonable remuneration for work:

• Commit to paying competitive wages and benefits according to relevant local standards.
• Strive to ensure that employees’ wages and benefits are sufficient to meet the basic needs of the employee and their families / legitimate dependents.
• Keep adequate records of the wages and social security fees you pay.

• Apply normal working hours that comply with applicable laws and collective agreements. Where no such regulation exists, working hours shall not exceed 48 hours (or 60 hours, including overtime) per working week on a regular basis. Overtime must be voluntary unless exceptions are allowed in collective or similar agreements.
  
  
• Provide all employees with at least one rest day (24 consecutive hours) of rest in every seven-day period.

Ways to ensure that employees do not work in excess:

• Employees’ weekly working hours do not exceed 60 hours, including overtime, except in emergency or exceptional situations. All overtime work is voluntary.
• The employer keeps verifiable working time procedures and records, including records of overtime hours, for all employees (per individual). Practices such as “double bookkeeping” on working hours are unacceptable.
• Workers have at least one day off in every seven-day period.
• Employees with family responsibilities, such as dependent young children or aged parents under their care, are given flexibility in their working arrangements to ensure equal opportunities.

• Allow employees to freely enter and leave their workplace and any housing provided by the Supplier.

All employees should be allowed to exercise their right to freedom of movement. This includes freely entering and leaving the workplace and any housing provided by their employer.

The Supplier must:

• Strive to contribute to the positive social and economic development of the communities impacted by its operations, and minimise any negative impacts of their operations on those communities.
• Strive to engage in meaningful dialogue with impacted communities.

Investing in communities can improve their quality of life and generate business benefits for the company in the form of community support and competitive advantage. Managing company actions responsibly helps minimise their negative socio-environmental impacts and maximise the positive ones.

Ways to support and engage with communities:

• Initiating and maintaining a dialogue with communities that are impacted by your operations. 
• If there are known stakeholder concerns, or if such arise, it is best to address them proactively. You can collaborate with partners, such as expert NGOs, on this work.
• In practice, you can, for example, support local educational projects, organizations that address the interests of vulnerable groups, or the cultural activities of indigenous communities.

The Supplier must:

• Use resources efficiently and ensure adequate operational control minimizing adverse environmental impacts. Depending on industry, operational controls can cover topics such as emissions and energy management; water effluents; raw materials and water use; and the storage and handling of chemicals, hazardous materials, and waste.

As the renewable materials company, Stora Enso is committed to respecting the local environment and combatting climate change. As our supplier, you play an important role in making this a reality. It is advisable that you conduct – and regularly update – an environmental risk assessment of your operations to help you address any aspects that could have a significant impact on the environment. This will enable you to create a register of the significant environmental aspects of your processes, products, and services, including: