Governance

Audit Committee considers the need for and appropriateness of a separate Internal Audit function on a regular basis. To date, the Audit Committee has concluded that, due to the size, organizational structure and largely centrally controlled financial management of the company, a separate Internal Audit function is not necessary.

In the absence of an Internal Audit function, attention is paid to periodical review of the written guidelines and policies concerning accounting, reporting, documentation, authorization, risk management, internal control and other relevant matters in all departments. Related controls are also tested from time to time. The guidelines and policies are coordinated by the company’s finance department with active involvement by the legal department.

The absence of a separate Internal Audit function is considered when defining the scope of the company’s external audit. Where necessary, the Internal Audit services will be purchased from an external service provider.

To facilitate transparency and exchange of information on Internal Audit related matters, the financial management team has frequent meetings with the auditors. The Audit Committee also meets regularly with the auditors.

The company has taken into use a whistleblowing line for any employees to notify the Board and Leadership Team of any compliance concerns.

Risk management and internal control processes at WIthSecure seek to ensure that risks related to the business operations of the company are properly identified, evaluated, monitored and reported in compliance with the applicable regulations.

WithSecure’s Board of Directors defines the principles of risk management and internal controls which are followed within the company. The Audit Committee assists the Board in the supervision of WithSecure’s risk management function. The CEO is accountable for ensuring that the risk management principles are implemented and applied constantly and consistently across the organization.

The primary goal of WithSecure’s risk management principles is to empower the organization to identify and manage risks more effectively. The potential negative impact and probability of different situations arising from our business operations on the company, its customers, or its partners are monitored as part of the risk management process.

WithSecure promotes continuous risk evaluation by the company’s personnel. The relevant operational risks identified through the risk management process are regularly reviewed by the CEO and Leadership Team and the company’s statutory auditor. Risk Management is an integrated part of WithSecure’s governance and management and the risk management process is aligned with the ISO-31000 standard. The Audit Committee regularly evaluates the effectiveness of the risk management system.

The following risks and uncertainties can adversely impact F‑Secure’s sales, profitability, financial condition, market share, reputation, share price or the achievement of the company’s short- and long-term objectives. The matters described here should not be construed as exhaustive list. The most significant risks are:

Cyber security consulting is negatively affected by the COVID-19 pandemic. Further slowdown in the new sales of software products and Managed Detection and Response (MDR) service may occur if the situation prolongs.

Goodwill is tested for impairment annually and whenever there is indication that it might be impaired. The impacts of the pandemic on cyber security consulting can be seen as such indication, and an impairment testing of consulting goodwill was carried out during second quarter based on updated long-term forecasts approved by the Board of Directors. Testing resulted in no need for impairment, although sensitivity of the testing has decreased. Management continues to assess the need for updated testing regularly.

Under pandemic an increase in credit losses and delayed customer payments may occur. Until the end of first half no significant risks have realized, but as the impacts of the pandemic on customers may arise in longer term, management has reassessed the provision for expected credit losses under IFRS 9 and a slight increase has been booked during the first half to address increased risk.

Endpoint security market is highly competitive. Operating system manufacturers have increased their focus to built-in security features and at the same time new vendors and technologies have emerged. WithSecure has to succeed in maintaining in-depth understanding of cyber security threat landscape, hacker techniques and technologies used as well as continue to innovate in defense technologies.

The cyber security market is consolidating due to economies of scale. WithSecure has to succeed in finding the right acquisition targets, as well as successfully integrating the target companies.

In a rapidly evolving industry it is vital to keep the products and services relevant to the customers while introducing new technologies to the market on-time. WithSecure is driving technology simplification and R&D effectivization initiatives as well as investments to artificial intelligence to ensure a competitive product portfolio.

Competition for capable personnel is increasing and there is structural undersupply of talent in the cyber security industry. WithSecure is continuously developing and adopting new ways of recruitment, building its own talent and knowledge pools and investing to training and development of personnel.

WithSecure operates globally in different countries, and local regulation is exposing the company to geopolitical risks, including, for instance, unfavorable tax matters or export controls, BREXIT being one example of these risks. Changes in regulations or their application, applicable to current or new technologies or services, may adversely affect WithSecure’s business operations.

Increased amount of operations and sites outside the Eurozone in different currencies exposes WithSecure to an increased risk related to currency fluctuations.

1. Business name and domicile 
   The Finnish name of the Company is WithSecure Oyj and the English name is WithSecure Corporation, and the Company's domicile is the City of Helsinki.
2. Line of activity
   The Company's line of activity shall be the production of software, the import, export and sale of computers, electric devices, software, and the supply of services related to information technology, as well as consultation, training and publication activities related to information technology. The Company may also be engaged in securities trading.
3. Book-entry securities system
   After a registration date specified by the Board of Directors, the shares of the Company will be incorporated in the book-entry securities system. After the registration date the right to receive funds distributed by the Company and to subscribe for shares when increasing the share capital shall be restricted to persons
   • Who have been registered as shareholders in the Shareholders' Register on the matching day
   • Whose right to payment has been registered on the matching day on the book-entry account of a registered shareholder and entered in the Shareholders' Register or
   • In case a share is nominee registered, on whose book-entry account the share has been registered on the record date and whose nominee has been registered in the Shareholders' Register of the Company on the record date as the nominee of the shares.
4. Board of directors
   The Company shall have a Board of Directors, which shall include at minimum three and at maximum seven ordinary members. The term of office of a member of the Board of Directors shall expire at the end of the first Annual General Meeting of Shareholders following the election.
5. Company president
   The Board of Directors of the Company shall appoint a President and determine his/her remuneration terms.
6. Signing of the business name
   In addition to the members of the Board of Directors, who can sign the business name of the Company jointly, the name can also be signed by the person or persons whom the Board of Directors has authorized to sign the business name, by the President of the Company and the Chairman of the Board of Directors alone, and by two members of the Board of Directors jointly. The Board of Directors shall decide on authorizing persons to sign for the Company per procuram.
7. Financial period
   The financial year of the Company is the calendar year.
8. Auditors
   The Company shall have one Auditor, who shall be an auditing entity approved by the Finnish Central Chamber of Commerce. The term of office of the Auditor shall expire at the end of the first Annual General Meeting of Shareholders following the election.

9. Call to a General Meeting and right to participate in and vote at the General Meeting
   The notice of a General Meeting of Shareholders shall be delivered to the shareholders within a period stipulated by the law by publishing the notice on the Company's website.

   To be entitled to participate in the General Meeting, a shareholder shall notify the Company about his/her intention to participate in the General Meeting no later than on the date indicated in the notice.

   At a General Meeting of Shareholders, each share has one (1) vote. The voting method shall be decided by the Chairman of the Meeting.

10. Annual General Meeting of Shareholders
    The Annual General Meeting of Shareholders shall be held annually on the date designated by the Board of Directors within a period from the end of the financial year as defined by the law. In addition to the domicile of the Company, the General Meeting of Shareholders can be held in Espoo or Vantaa. At the Annual General Meeting there shall be presented:
    • The financial statements and the Annual Report
    • The Auditors' Report (decisions made regarding)
    • The approval of the financial statement
    • The measures to which the profit or loss of the adopted balance sheet and/or consolidated balance sheet may give cause
    • The granting of release from liability to the Members of the Board of Directors and to the President
    • The remunerations of the Members of the Board of Directors and Auditors
    • The number of the Members of the Board of Directors (elected)
    • The members of the Board of Directors
    • One auditor and a reserve auditor, if necessary

On this WithSecure’s Whistleblowing page you can submit a Whistleblowing report if you have any knowledge or suspicion of misconduct or an attempt to conceal such misconduct related to WithSecure. Please kindly review WithSecure’s Whistleblowing Policy prior to filing your report.

The WithSecure’s Whistleblowing Channel is available in three languages, English, Finnish and Swedish. The Whistleblowing Channel directs you to provide all the information necessary for reporting and processing the report. Please kindly answer the questions as accurately as possible. Your assistance is highly appreciated.

You can submit your whistleblowing report via this link https://lantero.report/new/hhpartners.

The WithSecure’s Whistleblowing Channel is maintained by external service providers, HH Partners Attorneys-at-law and Lantero AB. As the Whistleblowing Channel is maintained by an external service provider, your report will always be reviewed by a person who is an impartial, independent and professional expert.

The information you report through the Whistleblowing Channel will be reviewed and reported to WithSecure by an independent expert from HH Partners. After submitting your report, the Whistleblowing Channel will provide you with a unique report-specific link where you will be informed of:

a)       the receipt of you report;

b)      any follow-up action taken based on your report; and

c)       any follow-up questions the expert may request from you based on your report, which you are able to answer through the link.

If you provide your email with your report, you will receive a reminder whenever there are questions or updated information behind the link. Otherwise, it is your responsibility to check from time to time if the information behind the link is updated.

Please note that if you express your suspicion and participate in the investigation of misconducts in good faith you will not be subject to negative sanctions and you will be protected by WithSecure. Misuse of the Whistleblowing Channel, i.e., filing deliberately false disclosure is considered a breach that can lead to further action against you.

By publishing a statement based on the UK Modern Slavery Act WithSecure sets a clear signal against slavery and servitude, forced or compulsory labor and human trafficking in its value chain.

At WithSecure, we constantly strive to create the best environment for employees to perform, innovate and develop. Treating every employee fairly and with respect is a fundamental part of the company culture. This is fully in line with our policy on human rights and our Code of Conduct.