organisation

In 2024, a revised code of conduct for suppliers was introduced, with a particular focus on suppliers in high-risk areas. This code sets out mutual responsibilities and encourages coope-ration based on transparency, fair payment terms, capacity planning and production coordination, and emphasises the importance of transparency throughout the supply chain. Read more about the code of conduct for suppliers here.

HEMA believes it is important that employees and other stakeholders are able to report suspected misconduct safely and confidentially. Reports may relate to breaches of laws and regulations, the code of conduct or other internal guidelines.

Employees can report concerns via HR, their line managers, the compliance officer or anonymously via the ‘Speak Up scheme*’. Whistleblowers are protected against discrimination. The legal department carries out an initial assessment of incoming reports and refers them to the relevant departments, such as HR or Risk & Internal Audit, in order to find an appropriate solution.

External confidential advisors submit an anonymised report each year. This provides insight into the nature and scale of reports and helps us to identify patterns and implement improvements.

HEMA’s management team is responsible for the strategy and its implementation. At HEMA, we value integrity, respect and trust: from how we work together to how we make decisions. With clear management, openness and room for initiative, we are building a HEMA that everyone is proud of.

The Supervisory Board has an Audit Committee, which also oversees the internal control system and risk management, as well as the integrity and quality of financial and non-financial reporting and the financial and non-financial reporting process.

To keep risks under control and ensure robust internal controls, we have structured our risk management as follows:

• a specialist ‘Risk & Internal Audit’ department that carries out risk analyses and conducts independent audits of critical processes;
• second-line teams, including those responsible for privacy, information security and safety, which manage risks and ensure compliance with laws and regulations in all countries where HEMA operates;
• internal control frameworks covering areas such as finance, cyber security and IT;
• a fixed planning and monitoring cycle comprising a multi-year plan, annual budgets, regular forecasts and management reports;
• established procedures and guidelines for financial policy, including a clear authorisation and procurement policy;
• a whistleblower scheme that allows for the anonymous reporting of suspected misconduct;
• a cyber strategy, supported by monthly meetings of the Information Security and Privacy Committee.

The executive board and the Risk & Internal Audit department report regularly to the Audit Committee on the functioning of risk manage­ment and internal controls. Sustainability issues are an explicit part of this. The follow-up to internal and external audit findings is discussed on a quarterly basis. Risk management provides independent insight into the effectiveness of our control measures.

In 2022, HEMA established its risk appetite. We review these twice a year and update them where necessary. In this way, we maintain a healthy balance between entrepreneurship, financial prudence and the creation of long-term value.

Our risk appetite is clear: “Generally speaking, we accept limited risks.” “When it comes to reputation, cybersecurity, product safety and compliance, we deliberately opt for a risk-averse approach.”

Through our risk management process, we identify risks and opportunities at an early stage and monitor them continuously. We have grouped the key themes into three categories: strategic, operational, financial and compliance.

HEMA monitors business conduct and integrity using a range of tools. Although specific KPIs have not yet been established for all aspects, we record the number of reports received through our reporting procedures, incorporate business conduct into onboarding and training programmes, and actively inform employees about the Speak Up scheme.

Specific measures are being implemented to prevent corruption and bribery. In 2025, no final convictions were handed down by the courts for breaches of anti-corruption and anti-bribery legislation, and no financial penalties were imposed. These findings confirm that the measures and procedures put in place contribute to acting with integrity and responsibility.

Over the coming years, our objectives will focus on further strengthening our corporate culture, ensuring robust governance and risk manage­ment, enhancing due diligence throughout the value chain, and increasing transparency regarding ESG performance and business conduct.