The main aspects of UPM's risk assessment are country risk, supply chain complexity risk and risks associated with production processes.
"The purpose of supplier selection process and the audit is to ensure compliance with UPM's requirements. Unclear cases are thoroughly inspected, and any detected shortcomings are addressed and necessary corrective actions are implemented", says Ilkka Nurmi, Senior Vice President, UPM Sourcing.
"The effectiveness of our risk assessment has been enhanced overall, and the process is now more exhaustive and accurate than before. Using external experts has improved the quality of the audits, especially in environments where accurate knowledge of local language and legislation is important. Nevertheless, audits are only one tool for risk management in different countries".
UPM also conducts supplier audits internally. The readiness for it has been improved by training internal employees in different sites around the world.
"UPM audits have mainly concentrated on high-risk countries, but based on risk assessment they are also conducted in low-risk countries like Finland", says Ilkka Nurmi.
Improvements in risk assessment accuracy
For example in China, UPM's audit partner is SGS, the world's leading auditing, verification, testing and certification company. Being able to conduct the audit in the supplier's native language and having knowledge of the local culture are substantial advantages that also facilitate dealing with challenging issues that arise during the audit.
"Typically, the focus has been on occupational health and safety and environmental issues”, says Tony Yang, the expert in charge of UPM audits at SGS.
"During the audits, we assess, for example, the measures UPM's subcontractors take to maintain their facilities, the firefighting equipment available at the mills or how first aid training is managed and carried out. Meanwhile, we also make sure that the subcontractors comply with the local and international regulations and UPM's requirements”.
According to Yang, the companies being audited are mainly positive regarding the requests, and the cooperation is smooth.
"In some cases, however, the companies are not sufficiently prepared for the audit, so we need to request for the necessary documentation several times. The concept of social compliance is also unfamiliar to some companies", he continues.
The UPM Supplier Code sets guidelines for the external suppliers to comply with. Based on risk assessment, UPM defines the areas for the audit. The auditor is then responsible for scheduling and conducting the audit and reporting the results. UPM's responsibility is to ensure the suppliers address any found issues as required.
Pending cases are closed as soon as UPM has sufficient evidence of the corrective actions carried out.
Vesa Puoskari
Read more
UPM Supplier and Third Party Code – foundation for conducting business responsibly
