Governance

Audit Committee considers the need for and appropriateness of a separate Internal Audit function on a regular basis. To date, the Audit Committee has concluded that, due to the size, organizational structure and largely centrally controlled financial management of the company, a separate Internal Audit function is not necessary.

In the absence of an Internal Audit function, attention is paid to periodical review of the written guidelines and policies concerning accounting, reporting, documentation, authorization, risk management, internal control and other relevant matters in all departments. Related controls are also tested from time to time. The guidelines and policies are coordinated by the company’s finance department with active involvement by the legal department.

The absence of a separate Internal Audit function is considered when defining the scope of the company’s external audit. Where necessary, the Internal Audit services will be purchased from an external service provider.

To facilitate transparency and exchange of information on Internal Audit related matters, the financial management team has frequent meetings with the auditors. The Audit Committee also meets regularly with the auditors.

The company has taken into use a whistleblowing line for any employees to notify the Board and Leadership Team of any compliance concerns.

Risk management and internal control processes at WithSecure seek to ensure that risks related to the business operations of the company are properly identified, evaluated, monitored and reported in compliance with the applicable regulations.

WithSecure’s Board of Directors defines the principles of risk management and internal controls which are followed within the company. The Audit Committee assists the Board in the supervision of WithSecure’s risk management function. The CEO is accountable for ensuring that the risk management principles are implemented and applied constantly and consistently across the organization.

The primary goal of WithSecure’s risk management principles is to empower the organization to identify and manage risks more effectively. The potential negative impact and probability of different situations arising from our business operations on the company, its customers, or its partners are monitored as part of the risk management process. Another objective of the risk management is to constantly monitor and pro-actively control the impact and/or probability of situations derived from our business operations which may have a negative impact on WithSecure, its customers, or its partners. Proactive monitoring, risk simulation and stress testing also allows building strategic resilience in the company and its business operations. Risk management may also be utilized to identify opportunities for benefit.

WithSecure promotes continuous risk evaluation by the company’s personnel. The relevant operational risks identified through the risk management process are regularly reviewed by the CEO and Global Leadership Team and the company’s statutory auditor. Risk Management is an integrated part of WithSecure’s governance and management, and the risk management process is aligned with the ISO-31000 standard. The Audit Committee regularly conducts a review of top operational risks and evaluates the effectiveness of the risk management system.

WithSecure operations are subject to risks and uncertainties that can impact the business performance, profitability, financial position, market share, reputation, share price or the achievement of its short-term and long-term objectives. These risks and uncertainties described here should not be considered as an exhaustive list.

The objective of WithSecure risk management is to identify various risks that could have an impact on the business, and to implement appropriate measures to mitigate the risks. In assessing the risks, WithSecure considers both the probability and the potential impact of each risk, as well as the resources required to manage and mitigate the risk. Ensuring business continuity in all situations is an essential part of the risk management. WithSecure risk management principles and process are described in the Corporate Governance Statement of 2023.

Market consolidation

The cyber security market is scattered to many providers of software and services. The large market participants are investing heavily in the development of embedded security and winning market share. Market consolidation is considered a likely development. WithSecure must succeed in its chosen strategy as well as in finding the right acquisition targets, and in integrating the acquired companies into its operations. As one of the smaller players in the market, the company must always keep itself relevant to the customers, by ensuring both up to date technology and good quality, timely services.

Geopolitical risks

Geopolitical uncertainties, such as the war in Ukraine, have significantly increased the risk of unexpected disruptions of the world economy and security stability. Likelihood of acts of terror impacting societal infrastructures has increased with this development.  Any such events could also impact WithSecure’s ability to run its business. The increasing activity of nation-state cyber criminals will continue to impose business interruptions also during 2024.

For corporate responsibility reasons, WithSecure is not conducting business with any Russian or Belarussian parties, even in cases where it would be permitted by the export control regulations.

WithSecure operates in different countries and is therefore exposed to country risks of each location.   Changing circumstances and regulation in different operating countries is exposing WithSecure to risks, such as unfavorable tax treatment or export controls. 

Environmental risks

As part of the sustainability materiality analysis, WithSecure has assessed the impact of the environmental risks, especially climate change, on its business. The company is a provider of software and services, and as such not significantly impacted by the environmental risks. Business continuity planning covers scenarios related to unavailability of resources due to natural disasters or other hazards.

Attracting and retaining talent

Unavailability of skilled personnel may result in inability of providing high-quality products and services to customers. Competition for skilled personnel is increasing and there is structural undersupply of talent in the cyber security industry. WithSecure is continuously developing and adopting new ways of recruitment, building its own talent and knowledge pools, and investing in training and development of personnel.

Partners

WithSecure’s cyber security products and services market model is very dependent on functioning partner channel and network.  It is critical for WithSecure to ensure it has the right partners in the regions and that the partners receive the needed support and that WithSecure’s cyber security offering is made available accordingly to the local demand. Not being able to serve the needs of the partners needs could result to negative impact on WithSecure’s business performance.

Product risks

WithSecure operates in a highly competitive market. Cybercrime is growing fast and becoming more innovative and professional. Large vendors make significant investments in their development and marketing activities, while new vendors are emerging in the market, and the operating system manufacturers are increasing their focus on built-in security features. WithSecure must succeed in maintaining in-depth understanding of cyber security threat landscape, following the hacker techniques and technologies, as well as continuing to innovate in defensive technologies.

Investments in new technologies and products come with the risk of not meeting the future requirements of the market. Agile methods are applied by WithSecure to ensure that its decisions regarding future technologies are aligned with the best information and expectations of the market developments.

Cyber security incident

Exposure to cyber security incidents threatens the confidentiality, integrity, and availability of WithSecure products and services, and their mitigation is considered as high priority in all parts of the company. WithSecure builds cyber resilience by continuously improving its capability to identify, protect, detect, and respond to relevant threats. Continuous efforts are taken to protect sensitive data of the company and its customers.

Intellectual property rights (IPR)

WithSecure protects its technologies and innovations through copyrights, patents, trademarks, and technology partnerships. While WithSecure uses all available protection mechanisms, the businesses are exposed to risks relating intellectual property claims, particularly in the US markets.

Inflation and interest rates

Cost inflation in the countries where WithSecure operates increases the risk for negative development of the cost structure. This is monitored very closely, and inflation will also most likely require mitigation actions to retain workforce in the company. Increasing interest rates could limit the possibilities of external funding.

Liquidity risk

As a company still improving its profitability, WithSecure must focus on accurate cash planning and prompt collections to ensure liquidity of all group companies and to avoid needs of short-term financing. 

Currency fluctuations

Increasing volume of operations outside the Euro zone in different currencies exposes WithSecure to an increased risk related to currency fluctuations.

1. Business name and domicile 
   The Finnish name of the Company is WithSecure Oyj and the English name is WithSecure Corporation, and the Company's domicile is the City of Helsinki.
2. Line of activity
   The Company's line of activity shall be the production of software, the import, export and sale of computers, electric devices, software, and the supply of services related to information technology, as well as consultation, training and publication activities related to information technology. The Company may also be engaged in securities trading.
3. Book-entry securities system
   After a registration date specified by the Board of Directors, the shares of the Company will be incorporated in the book-entry securities system. After the registration date the right to receive funds distributed by the Company and to subscribe for shares when increasing the share capital shall be restricted to persons
   • Who have been registered as shareholders in the Shareholders' Register on the matching day
   • Whose right to payment has been registered on the matching day on the book-entry account of a registered shareholder and entered in the Shareholders' Register or
   • In case a share is nominee registered, on whose book-entry account the share has been registered on the record date and whose nominee has been registered in the Shareholders' Register of the Company on the record date as the nominee of the shares.
4. Board of directors
   The Company shall have a Board of Directors, which shall include at minimum three and at maximum seven ordinary members. The term of office of a member of the Board of Directors shall expire at the end of the first Annual General Meeting of Shareholders following the election.
5. Company president
   The Board of Directors of the Company shall appoint a President and determine his/her remuneration terms.
6. Signing of the business name
   In addition to the members of the Board of Directors, who can sign the business name of the Company jointly, the name can also be signed by the person or persons whom the Board of Directors has authorized to sign the business name, by the President of the Company and the Chairman of the Board of Directors alone, and by two members of the Board of Directors jointly. The Board of Directors shall decide on authorizing persons to sign for the Company per procuram.
7. Financial period
   The financial year of the Company is the calendar year.
8. Auditors
   The Company shall have one Auditor, who shall be an auditing entity approved by the Finnish Central Chamber of Commerce. The term of office of the Auditor shall expire at the end of the first Annual General Meeting of Shareholders following the election.

9. Call to a General Meeting and right to participate in and vote at the General Meeting
   The notice of a General Meeting of Shareholders shall be delivered to the shareholders within a period stipulated by the law by publishing the notice on the Company's website.

   To be entitled to participate in the General Meeting, a shareholder shall notify the Company about his/her intention to participate in the General Meeting no later than on the date indicated in the notice.

   At a General Meeting of Shareholders, each share has one (1) vote. The voting method shall be decided by the Chairman of the Meeting.

10. Annual General Meeting of Shareholders
    The Annual General Meeting of Shareholders shall be held annually on the date designated by the Board of Directors within a period from the end of the financial year as defined by the law. In addition to the domicile of the Company, the General Meeting of Shareholders can be held in Espoo or Vantaa. At the Annual General Meeting there shall be presented:
    • The financial statements and the Annual Report
    • The Auditors' Report (decisions made regarding)
    • The approval of the financial statement
    • The measures to which the profit or loss of the adopted balance sheet and/or consolidated balance sheet may give cause
    • The granting of release from liability to the Members of the Board of Directors and to the President
    • The remunerations of the Members of the Board of Directors and Auditors
    • The number of the Members of the Board of Directors (elected)
    • The members of the Board of Directors
    • One auditor and a reserve auditor, if necessary

The net impact of WithSecure's activities has been quantified by the Upright Project, an external firm, using a net impact quantification model that uses machine learning-based technology to process the knowledge contained in scientific articles and resulting in a net impact ratio that is comparable between companies. The results, supporting our Maximizing Net Impact approach, are presented below.

The net impact profile is a bird’s eye view of the holistic net impact created by WithSecure’s business. The bars to the left illustrate the resources used and the negative impacts created by WithSecure, while the bars to the right depict the positive impact created and what is achieved with the use of those resources. The analysis is based on WithSecure’s core business, meaning the products and services offered, and it takes into consideration the entire value chain of those services – from the materials needed to produce the hardware required all the way to the customer industries WithSecure serves. The profile has been calculated and produced by the Upright Project’s net impact quantification model which uses machine-learning-based technology to process the knowledge contained in millions of scientific articles. Upright is actively developed, and the most recent research findings are continuously incorporated as part of the data.

WithSecure’s net impact ratio of +55% is clearly positive, i.e., WithSecure creates more value compared to the resources it uses. This highly positive score signifies that WithSecure efficiently utilizes modest environmental and scarce human resources while generating a diverse array of positive impacts on society, knowledge, and health.

Climate change is feeling increasingly more real across the globe. We are beginning to understand that the ICT sector significantly contributes to the emissions. We process more data, in more applications and in many areas of life. At WithSecure, we continue to believe that the tech sector has an important role to play in reducing the emissions footprint – both in the cloud and in the endpoint devices that we use every day.

The WithSecure carbon footprint is largely composed of indirect emissions.

We will continue to follow up the emissions (both absolute and relative) according to the GHG Protocol and to introduce measures of improving visibility on the activity-based carbon footprint of our largest vendors.

As our first informal target, we commit to reducing the carbon footprint to 75 tons of CO2e per million EUR of revenue. This will allow the company's growth but without an increase in the carbon footprint. In addition, our target is to maintain the flight emissions at the level of the year 2023.

Read more about W/Sustainability in WithSecure's Sustainability report 2023 and Sustainability Policy.

Our purpose is to build and sustain trust in a digital society. Every single human “out there” is part of the digital society, in one way or another. Therefore, if we want to be successful, we must be as diverse as the society we wish to serve. We deliver outcome-based security through our diverse workforce and by making sure all our employees feel like they can bring their best and true self to work.

In the past decade, we have seen the wide repercussions of a single compromise in our digital supply chain. Therefore, in addition to being part of the solution through the cybersecurity products and services that we offer, we also want to be a responsible part of the supply chain by taking reasonable measures to continuously elevate the security posture of our estate.

WithSecure exists to build and sustain trust in the digital society. At WithSecure, we want to do what is right. Trust ensures we will succeed in our mission. Trust is earned when action matches words. Everyone working for WithSecure has a critical role in building and maintaining trust in the eyes of each other and earning the trust of our customers.

On this WithSecure’s Whistleblowing page you can submit a Whistleblowing report if you have any knowledge or suspicion of misconduct or an attempt to conceal such misconduct related to WithSecure. Please kindly review WithSecure’s Whistleblowing Policy prior to filing your report.

The WithSecure’s Whistleblowing Channel is available in three languages, English, Finnish and Swedish. The Whistleblowing Channel directs you to provide all the information necessary for reporting and processing the report. Please kindly answer the questions as accurately as possible. Your assistance is highly appreciated.

You can submit your whistleblowing report via this link https://lantero.report/new/hhpartners.

The WithSecure’s Whistleblowing Channel is maintained by external service providers, HH Partners Attorneys-at-law and Lantero AB. As the Whistleblowing Channel is maintained by an external service provider, your report will always be reviewed by a person who is an impartial, independent and professional expert.

The information you report through the Whistleblowing Channel will be reviewed and reported to WithSecure by an independent expert from HH Partners. After submitting your report, the Whistleblowing Channel will provide you with a unique report-specific link where you will be informed of:

a)       the receipt of you report;

b)      any follow-up action taken based on your report; and

c)       any follow-up questions the expert may request from you based on your report, which you are able to answer through the link.

If you provide your email with your report, you will receive a reminder whenever there are questions or updated information behind the link. Otherwise, it is your responsibility to check from time to time if the information behind the link is updated.

Please note that if you express your suspicion and participate in the investigation of misconducts in good faith you will not be subject to negative sanctions and you will be protected by WithSecure. Misuse of the Whistleblowing Channel, i.e., filing deliberately false disclosure is considered a breach that can lead to further action against you.

The Whistleblowing Channel is subject to data protection legislation. Please see WithSecure’s Privacy Notice for Whistleblowing Channel.

By publishing a statement based on the UK Modern Slavery Act WithSecure sets a clear signal against slavery and servitude, forced or compulsory labor and human trafficking in its value chain.

At WithSecure, we constantly strive to create the best environment for employees to perform, innovate and develop. Treating every employee fairly and with respect is a fundamental part of the company culture. This is fully in line with our policy on human rights and our Code of Conduct.