Trevian Asset Management Oy – Business Continuity Plan
1. Introduction and Objectives
The objective of this Business Continuity Plan is to ensure that Trevian Asset Management Oy is able to maintain and continue its critical operations during significant disruption situations, to minimize impacts on personnel, clients, and stakeholders, and to recover to normal operations in a controlled manner. The guiding principles of the plan are risk awareness, rapid response, transparent communication, and responsibility.
This continuity plan takes into account the results of the double materiality assessment conducted in August 2025 and the risks identified therein, including technological, operational, personnelrelated, reputational, and financial risks.
2. Definition and Characteristics of a Disruption Situation
A disruption situation is an event that threatens:
– The safety of premises and personnel
– The company’s operations, reputation, or assets
– Clients’ assets or the continuity of services
Examples of serious disruption situations include:
– Complete interruption of operations
– Misuse of assets or data breach
– Legal consequences for the company
– Negative media exposure
– Death or serious injury of an employee
3. Risk Management
Risk assessment is an essential part of the business continuity plan, as it enables the identification of critical threats, evaluation of their likelihood and impact, and definition of preventive and corrective measures.
Trevian’s annually updated risk management document compiles key strategic risks, their impacts, and mitigation measures. The document covers strategic, operational, and financial risks, as well as an assessment of risk status and management tools. The overall risk framework is reviewed annually by the Board of Directors to ensure it remains up to date in a changing market and operating environment.
4. Crisis Management Process
Crisis management proceeds in phases:
| Phase | Action |
|---|---|
| 1. Alert and situation assessment | Notification to the CEO; collection of facts: what has happened, who is affected, and what the risks are |
| 2. Activation of the crisis management team | The CEO convenes key personnel; roles are assigned and the deputy system is activated |
| 3. Action plan and communication | Internal communication to personnel; external communication to clients, authorities, and media; Trevian’s crisis communication plan is applied |
| 4. Ongoing management and monitoring | Situation overview is updated; decisions on critical measures are made |
| 5. Recovery and post-assessment | Return to normal operations; documentation of lessons learned and reporting to the Board |
4. Crisis Communication – Operating Model
Communication chain:
The CEO approves external communications; the Communications Manager coordinates communications; HR manages internal communication.
Channels:
Teams, email, SMS alerts; externally the website, client communications, and media
Phases:
1. Post-crisis communication: situation updates and final report
2. Initial notification to personnel immediately after identifying the crisis
3. Communication to clients and stakeholders once the situation overview is confirmed
4. Media management: one designated spokesperson (CEO)
5. Cybersecurity and Information Security
– Immediate actions: connections are disconnected and the ICT partner (Vetonaula Oy) is notified
– Recovery: restoration from backups, integrity testing, and documentation
– Prevention: regular updates, personnel training, and an annual information security test
6. Financial Preparedness
– The CFO prepares a cash flow analysis immediately at the start of a crisis
– Payment prioritization: salaries and critical services
– Stress testing: 30-day cash flow without income
– Review of insurance coverage and compensation processes
7. Pandemic and Personnel Risks
– Remote work readiness: VPN, devices, and information security
– Deputy system: activated immediately at the beginning of a crisis
– HR monitoring: HR monitors the personnel situation
– Psychological support: provided after the crisis in cooperation with occupational health services
8. Exercises and Testing
– Annual crisis exercise (e.g. IT disruption, reputational crisis)
– IT system recovery testing at least once a year
– Testing of communication chains (SMS alerts, Teams channel)
– A report is prepared for each exercise and lessons learned are integrated into the plan
9. Climate Change Risk Management and ESG MEasures
a. Physical Risks
– Property-specific climate risk analyses (extreme weather, floods, heatwaves)
– Preparedness measures: stormwater systems, backup power, ventilation
– Regular maintenance and investment planning
b. Transition Risks
– Monitoring legislative changes and updating operating practices
– Emission reduction targets
– Reporting in accordance with GRESB and other standards
c. Energy Efficiency and Resource Use
– Smart metering and control systems
– Investments in renewable energy
– Energy efficiency also in vacant spaces
d. Waste Management and Circular Economy
– Development of waste sorting and recycling
– Reporting of waste and recycling data
e. Chemicals and Pollutants
– Tenant chemical safety: registers, guidelines, and audits
f. Biodiversity
– Green roofs, pollinator-friendly plants, and consideration of biodiversity in projects
g. Occupational Safety and Wellbeing
– Risk assessments, occupational health services, and value chain audits
h. Social Inclusion and Accessibility
– Accessibility and equality
– User surveys and feedback channels
i. Value Chain Transparency
– Responsibility audits of partners and contractual requirements
j. Regulation and Financing
– Monitoring and reporting of ESG requirements
k. Communication and Data Management
– Development of data management processes and reporting tools
– Active communication with stakeholders
10. Responsibility Matrix – Crisis Management Team
| Role | Responsible person | Responsibilities |
|---|---|---|
| Head of Crisis Management Team | Reima Södervall | Leads the crisis management team and is responsible for personnel safety and implementation of the continuity plan |
| Finance | Minna Jussila | Ensures financial stability during the crisis |
| Human Resources | Tiina Kaakkolahti | Responsible for personnel support measures during and after the crisis |
| Operational Responsibility | Kim Särs / Elisa Loitto | Responsible for operational crisis management and coordination |
| Property and Premises Security | Hannu Tamminen | Responsible for property security measures |
| Communications | Kari Koliseva | Coordinates crisis communication and post-crisis communication |
| Information Systems and Information Security | Tiina Kaakkolahti / Jyri Männikkö, Vetonaula Oy | Coordinates IT system functionality and information security during and after the crisis |
Approved by the Board of Directors of Trevian Asset Management Oy on 23 February 2026.