Risk management objectives and scope 

The purpose of internal control is to ensure the efficiency and productivity of the Modulight’s operations, the reliability of financial and operational management reporting, and compliance with applicable legislation and regulations and internal guidelines within the Company. 

Internal control is an essential part of the company’s business management and in ensuring the achievement of its business objectives. The company strives to organize internal control effectively so that deviations from the company’s targets are detected as early as possible or so that they can be prevented. 

Modulight’s internal controls comprise of the internal control policy approved by the Board of Directors, and the decision-making and approval procedures, control points defined in a uniform manner in the various processes, as well as their monitoring and undertaking of corrective measures. Risk assessment forms the basis for effective internal control. Control functions ensure that the realization of identified risks is minimised. 

Modulight’s risk management is guided by the risk management policy. The objective of the risk management is to create operational conditions in which business-related risks are managed comprehensively and systematically at all levels of the organisation. The principle is to identify risks, assess their magnitude and significance, define risk mitigation measures and decide on their implementation and monitor of their effects. 

Risk assessment 

Modulight uses a group-level risk assessment and monitoring model and conducts a comprehensive risk assessment annually, in which the most significant risks to the company’s strategy and other objectives are assessed, as well as their probability and impact on business, and risk management measures are mapped. If necessary, the risk assessments are updated, for example, for the risk assessments in the interim reports.  

Modulight’s Board of Directors is responsible for defining the company’s risk-taking level, decides on taking strategic risks and is responsible for monitoring the results of risk management and evaluating its effectiveness. 

Risks relating to Modulight’s business 

• Decreased availability of the Company’s materials or loss or decreased performance of the Company’s material suppliers or substantial price increase in their services may adversely affect the Company; 
• The Company operates complex, hard-to-replace machinery within a single production plant, any disruption of which could adversely affect the Company’s business; 
• The Company’s production and business are affected by the ongoing global shortage of semiconductors; 

• The Company may be unable to obtain or maintain international regulatory qualifications or approvals for its current or future products and indications, which could harm its business; 
• The Company’s ability to compete depends upon its ability to innovate, to develop and commercialize new products and product enhancements, and to identify new markets for its technology; 
• Increased competition or new technologies may adversely affect the Company’s results; 
• The Company’s business is exposed to financial, social and political developments in countries across the world which may adversely affect the Company’s results; 
• Within the medical and biomedical sectors, the Company’s business strategy depends on the success of its customers; 

• The Company may suffer interruptions or failures of its information technology (“IT”), network or communications systems and/or cyber security breaches; 
• If the Company is unable to guard its intellectual property rights (“IPRs”) and trade secrets, its competitive advantage could be eroded; and 
• If the Company or the Company’s customers fail to obtain or maintain necessary U.S. Food and Drug Administration clearances for its products and indications, these clearances may be delayed and there may be federal or state level regulatory changes in the United States that may harm the Company’s business operations.  

Risk reporting 

Risks and associated changes are reported to the company’s Board of Directors. Modulight’s Board of Directors discusses the most material risks, their management and evaluates the effectiveness of risk management at least once a year.  

Financial and operational risks and the related risk management actions are regularly reported to the management team. Strategic risks are discussed by the Board of Directors annually in connection with the company’s strategy discussion.  

Central risks and risk management actions are reported annually in the annual report and interim reports, and on a case by case basis as necessary. 

Internal audit 

Modulight does not have a separate internal audit function, and internal audit responsibilities have been divided inside the company among different bodies and functions as described below. The Board of Directors may use external experts to conduct separate evaluations of the control environment or control functions. The audit plan of the company’s external auditor must take into account the fact that the company does not have an internal audit function. 

Modulight complies with the EU Market Abuse Regulation ((EU) 596/2014 as amended) and with the lower-level regulations issued pursuant thereto as well as with the Finnish Securities Markets Act (746/2012 as amended), regulations and guidelines issued by the competent authorities, and Nasdaq First North Growth Market – Rulebook and the Guidelines for Insiders by Nasdaq Helsinki Ltd). 

The company’s insider guidelines consist of the Nasdaq Helsinki Ltd’s insider guidelines in force at the time, with the company-specific specifications. Modulight’s Insider Policy has been approved by the Board of Directors. Modulight has appointed an insider manager, who is responsible for maintaining insider lists in the company, handling trading restrictions and the obligation to report and disclose transactions, internal communication and training related to insider matters, and the supervision of insider matters. The company has internal procedures for disclosing inside information, possibly postponing the disclosure of inside information and maintaining project-specific insider lists. 

The company has defined, as persons discharging managerial responsibilities, the members and deputy members of the Board of Directors, the CEO and its deputy, as well as the members of the Group Management (“Managers”). Managers and their closely associated persons must report their own transactions conducted with the company’s financial instruments or financial derivatives to the company promptly and no later than three business days after the date of the transaction. 

Managers’ transactions 

Modulight shall publish the transaction announcements made by the Managers and their closely associated persons in accordance with Article 19 of the MAR in a company release without delay and no later than two (2) business days after receiving the notification.  

The company complies with the trading restriction on managers under Article 19 (11) of the MAR Regulation (closed period) of 30 days before the announcement of an interim financial report or a year-end report. In addition, the company has separately identified certain persons who participate in the preparation of financial statements or who have access to the relevant information and who are subject to a trading restriction of similar length and content (closed period). 

Notification of transactions​

The Managers and their close associates are obliged to notify the company and the Financial Supervisory Authority of the transactions made with the company’s financial instruments without delay and no later than within three working days from the date of the transaction.​

​The company and the Financial Supervisory Authority must be notified of at least all transactions that exceed the annual threshold of EUR 5,000. Notifications are made using the Financial Supervisory Authority’s electronic form and sent to the company by e-mail to    and to the Financial Supervisory Authority using a secure e-mail connection: https://securemail.bof.fi to johdonkaupat@finanssivalvonta.fi.

Insider Policy

The Disclosure Policy describes the key principles that Modulight, as a listed company, complies with in its investor communication and financial reporting and when communicating with its shareholders and other capital market parties, media and other stakeholders. The key principles of the communication and disclosure of the Company are timeliness, consistency, impartiality, transparency, and responsibility.

The Company adheres to a 30-day silent period before the publication of any financial statements.

Disclosure Policy

Modulight has a Whistleblowing Channel through which any suspected abuse of the regulations and provisions can be reported. The whistleblowing channel is a specialized service, designed to protect a whistleblower’s identity when a report is made. If the whistleblower does not disclose his/her identity when making the report, he/she will stay anonymous throughout the whole process.  

All received reports are handled confidentially.  

Read our Whistleblowing Policy here.

Whistleblowing Policy

According to the Articles of Association, the Company must have an auditor, which is an audit firm approved by the Finnish Patent and Registration Office. The auditor’s term of office ends at the end of the first Annual General Meeting following the election. 

The statutory audit includes the audit of the Company’s accounts, financial statements and administration. In addition to the annual auditor’s report, the auditors regularly report to the Board of Directors on their audit findings and participate annually at least in one Board meeting. 

The Board of Directors prepares a proposal for the election of the auditor and the auditor’s fee for the General Meeting, and the General Meeting elects the Company’s auditor and decides on the auditor’s fee. 

Moore Rewinet Oy Ab, acts as the Company’s Auditor with Jari Paloniemi, Authorised Public Accountant, as the auditor with principal responsibility. Jari Paloniemi is registered in the register of auditors referred to in Chapter 6, Section 9 of the Auditing Act (1141/2015, as amended). 

Danske Bank A/S, Finland Branch will act as the Company’s Certified Adviser referred to in the Nasdaq First North Growth Market Rulebook.  

Contact details of the Certified Adviser: 

Danske Bank A/S, Finland Branch
Televisiokatu 1
00240 Helsinki
Finland
Tel. +358 40 414 5358