The Canon Audit — Annual Self-Assessment

First published 26 Aug 2026 · Last verified 29 Aug 2026

Lesson 117.1 — Why Audit Yourself: The Logic of the Annual Review

Every Nepali household with farmland knows a simple truth: you do not wait until the paddy has failed to check on it. You walk the field every few weeks. You check the water level in the canal, you look for pests on the leaves, you see whether the bund, the small earthen wall that holds the water in, has cracked anywhere. Investing works the same way, except most people never walk their own field. They buy shares, they watch the NEPSE index move up and down on their phone, and they never once sit down and ask themselves plainly: how did I actually perform this year, not just in returns, but in behaviour?

This chapter is about building that habit. We are going to call it the Canon Audit, a once-a-year, structured, honest self-assessment where you compare what you actually did as an investor against what you promised yourself you would do. It is not a tax audit and it is not a SEBON inspection. Nobody is checking your homework except you. That is exactly what makes it hard, and exactly why it matters.

Think of it like the annual health checkup that many salaried Nepalis now get through their office insurance. You do not wait for chest pain to check your blood pressure. You get blood drawn, you get your weight and sugar checked, once a year, on a schedule, whether you feel fine or not. The value of the checkup is not that it always finds something wrong. The value is that it finds problems while they are still small and fixable, long before they become a heart attack. A portfolio works exactly the same way. Small mistakes, a slightly oversized position here, a skipped quarterly report there, do not sink an investor in one year. They compound quietly, year after year, until one bad year exposes all of them at once. The Canon Audit is the checkup that catches the drift early.

Let us meet the person who will guide us through this chapter. Her name is Sunita Basnyat, and she is a civil engineer working for a private construction firm in Kathmandu, living in Anamnagar. Sunita started investing in NEPSE shares nine years ago, initially through her father's demat account and then through her own once she turned twenty-five. Somewhere in her fourth year of investing, after a particularly painful year where she chased a hydropower IPO rumour on a friend's tip and lost badly on a stock she never researched, she decided she needed a system. She wrote out what this Canon calls an investment constitution, the personal, written set of rules an investor commits to before market excitement can override good judgment: how much of her portfolio could sit in any one sector, when she would and would not use margin lending, how often she would read company reports, what she would do if a stock fell thirty percent.

But a constitution written and forgotten is worthless. So Sunita also built a ritual: every year, on Baisakh 1, the first day of the Nepali new year, before she does anything else related to money, she sits down for what she now calls her Canon Audit. It usually takes her a full Saturday. She makes tea, she opens a spreadsheet, and she goes through the past year of her investing life the way a mechanic goes through a vehicle before a long highway journey, checking every part whether or not it seems to be making noise.

Why does this need to be scheduled and structured, rather than something you do whenever you feel like it? Because human memory is a liar, especially about our own mistakes. If you ask most investors, at any random moment, whether they have been following their own rules, almost everyone will say yes. It is only when you force yourself to lay out the actual transaction history, actual sector allocation, actual reading log, side by side with the rules, that the gaps become visible. This is exactly why a farmer walks the whole field on a schedule rather than only looking at the parts that catch his eye. The parts that catch your eye are usually the ones already doing fine. The weak corner of the field, the one quietly losing water through a crack in the bund, is the one you would walk right past if you were not making yourself look.

There is a second reason the audit must happen every year, not sporadically. NEPSE itself changes constantly: new IPOs get listed, SEBON, the Securities Board of Nepal, which is the government regulator overseeing the stock market and brokers, issues new directives, NRB, Nepal Rastra Bank, the central bank that regulates the banking and lending system, adjusts its rules on margin lending and bank capital, and companies you hold merge, issue bonus shares, or change their business entirely. An investor whose last serious self-review was three years ago is not just undisciplined, they are also very likely out of date. The audit is where you refresh your understanding of the current rules at the same time as you review your own conduct.

Sunita's audit ritual has five fixed parts, which map onto the five lessons that follow in this chapter: gathering the evidence, checking constitutional compliance, checking sector and leverage discipline, checking research and regulatory habits, and finally scoring the year and setting next year's targets. We will walk through her actual audit from three years ago, the year she discovered a serious problem hiding inside what looked, at first glance, like a very good year.

That year, 2080 in the Nepali calendar, Sunita's portfolio had grown handsomely. NEPSE had a strong run, and on paper she was up nearly forty percent. Most investors, seeing that number, would have closed the laptop and gone out for momos to celebrate. Sunita did that too, but first she sat down for her audit, and what she found underneath the happy headline number was a portfolio that had quietly broken two of her own rules for most of the year without her noticing. We will return to exactly what she found, and how she fixed it, as we go through each stage of the process below.

Lesson 117.2 — Gathering the Evidence: Rebuilding the Year from Your Data Pipeline

You cannot audit what you cannot see clearly, and memory alone is not evidence. This is why the first stage of the Canon Audit is not judgment at all, it is simply assembling the raw facts of the year. Think of this like preparing your documents before visiting a government office in Nepal: you do not walk into the Malpot office, the land revenue office, hoping to explain your case verbally. You bring the citizenship copy, the land ownership certificate, the tax clearance. Evidence first, argument second. The Canon Audit works the same way.

This is where the data pipeline you built earlier in this Canon becomes essential. Recall that a data pipeline, in the way this book has used the term, is simply the organised, repeatable system you use to pull in and store information about your holdings: your broker's transaction history, the daily or weekly closing prices of your stocks, company announcements from the Nepal Stock Exchange website, and dividend or bonus share records. If your data pipeline has been running properly all year, gathering the evidence for your audit takes an afternoon. If it has not, gathering the evidence can take a week, and that delay itself is a finding, because a broken data pipeline is one of the most common silent failures an otherwise careful investor can have.

Sunita's evidence-gathering step has four parts, each answering a different question about the year.

First, the transaction ledger. She exports every buy and sell order from her broker account for the full year and lists them in date order. This tells her not just what she bought, but when, and crucially, why, because she keeps a one-line note next to every trade explaining her reason at the time. This is the single habit she credits most for making her audits honest, because it stops her from quietly rewriting history in her own favour. It is very easy, a year later, to convince yourself you bought a stock for a sound reason when actually you bought it because a relative mentioned it at a wedding. The contemporaneous note does not let you lie to yourself.

Second, the portfolio snapshot history. Rather than looking only at where her portfolio stands today, Sunita pulls up snapshots from four points in the year, roughly every three months, showing exactly what percentage of her total invested money sat in each sector: commercial banks, development banks, hydropower, life and non-life insurance, microfinance, hotels, and so on. A single end-of-year snapshot can hide a lot. A stock that spiked in the middle of the year and then fell back by year end will look unremarkable at the final snapshot, even though for several months it represented a dangerously large slice of her portfolio. Quarterly snapshots catch drift that an annual snapshot alone would miss entirely.

Third, the reading log. Earlier chapters of this Canon urged every investor to keep a research library, a personal, organised collection of the annual reports, quarterly financial disclosures, and management commentary for every company they hold or are considering. Sunita's reading log is simply a dated list of what she actually read that year: which quarterly report of which company, which SEBON circular, which NRB monetary policy statement. If a company she holds shares in published four quarterly reports that year and her log shows she only read one of them, that is evidence, not an opinion.

Fourth, the regulatory tracker. This is the running list, also built earlier in this Canon, of regulatory changes relevant to her holdings: changes in the capital adequacy requirements NRB sets for banks, changes in margin lending rules, new SEBON directives on IPO allotment or insider trading disclosure, changes in dividend distribution rules. Sunita checks whether her tracker was actually updated through the year or whether, as sometimes happens, she let it go stale for months at a stretch.

It was while assembling exactly these four exhibits, for the 2080 audit, that Sunita first noticed something odd. Her transaction ledger showed she had bought shares of two different hydropower companies in Chaitra, the last month of the Nepali fiscal year, both times with the same note attached: "everyone at office is buying hydropower, index is rallying." Not a single note referencing an annual report, a project completion timeline, or a power purchase agreement with the Nepal Electricity Authority. That one detail, sitting quietly in her own ledger, was the first thread that, once pulled, unraveled a much bigger problem, which we will trace fully in Lesson 117.4.

For now, the discipline to notice is this: gathering evidence is not a formality to rush through before the "real" audit begins. Often, as happened to Sunita, the evidence-gathering stage itself reveals the finding, if you read your own ledger honestly instead of skimming it.

One more point on evidence-gathering deserves emphasis, because it trips up even careful investors. When you pull your portfolio snapshot, use invested cost or, better, actual market value at each snapshot date, not a rough guess from memory. NEPSE prices move quickly, and a stock that felt like a small position when you bought it can become a large position purely through price appreciation, without you ever placing another order. This is precisely the kind of drift that a memory-based review misses and that a document-based review catches every time.

Lesson 117.3 — The Constitution Check: Did You Follow Your Own Rules?

With the evidence assembled, the next stage is to place it directly beside your investment constitution and ask, clause by clause, whether you actually did what you said you would do. This is the heart of the Canon Audit, and it is worth explaining why this comparison, and not simply "did I make money," is the correct question to be asking.

Imagine two investors in the same year. The first followed every rule in her constitution: she never exceeded her sector limits, she never used margin lending beyond her stated ceiling, she sold a stock exactly when it hit her predetermined stop-loss level, and she still lost money, because the whole market fell that year. The second investor broke every one of his rules, chased tips, overloaded on one hot sector, and made spectacular returns because that sector happened to rally. Which investor had the better year?

The Canon's answer, and it is a deliberately uncomfortable one, is the first investor. She had the better year, because investing is a long game played across many years, and the habits that produce good outcomes over decades are not the same as the habits that produce good outcomes in any single lucky year. The second investor's approach will eventually meet a year where the hot sector collapses instead of rallying, and because he has no rules restraining his exposure, that collapse will be severe. The first investor's discipline is what will let her survive fifteen or twenty market cycles instead of blowing up in one of them. This is why the constitution check does not ask about your percentage return at all. It asks only: did you follow your own rules.

The mechanical process is simple. Sunita keeps her investment constitution as a numbered list of perhaps fifteen rules. For 2080's audit, she went through each one and marked it Followed, Partially Followed, or Broken, with a specific piece of evidence from her four exhibits supporting the mark. Rules like "I will not invest in an IPO or a newly listed company until at least two quarterly reports have been published" are easy to check against the transaction ledger. Rules like "I will read the annual report of every company before increasing my position by more than twenty percent" require cross-referencing the ledger against the reading log.

This is where Sunita's 2080 audit produced its second major finding, connected to the hydropower purchases we noted in the previous lesson. Her constitution contained a clear rule: no new position exceeding five percent of total portfolio value without at least one full quarterly or annual report reviewed first. When she checked her two Chaitra hydropower purchases against her reading log, neither company had a single entry. She had broken her own rule, twice, in the same month, during a period when the broader NEPSE hydropower sub-index was rallying hard on general enthusiasm rather than on anything specific to those two companies.

What made this a genuine constitution check finding, rather than just an isolated bad decision, was that when Sunita looked further back, she found the pattern had actually started three months earlier. In Poush, she had made a similar unresearched purchase in a third hydropower name, also without a reading log entry, also justified in her notes only by reference to what colleagues were discussing. Seen in isolation at the time, each purchase felt small and forgivable. Seen together in the audit, they showed a clear erosion of a specific rule over a specific three-month window, coinciding with the exact period the sector was most exciting to talk about at the office.

This is exactly why the constitution check must be done as a full-year review rather than trade by trade in real time. In the moment, each individual decision can be rationalised. It is only the aggregated, dated record, reviewed with a full year's distance, that exposes the pattern. This is the same reason a joint family's monthly household accounts often look fine but the yearly total suddenly shows spending has crept up badly. Nobody spent recklessly on any single day. The drift only becomes visible in the annual total.

The constitution check should end with a simple tally: how many rules were fully followed, how many partially followed, how many broken outright. This tally feeds directly into the canon score we will calculate in Lesson 117.6, but even before scoring, the tally itself is informative. Sunita's 2080 tally showed twelve of fifteen rules followed, two partially followed, and one broken, the research-before-buying rule specifically in hydropower. A single broken rule out of fifteen might sound minor, but as we will see in the next lesson, this particular broken rule connected directly to a second, larger problem in her sector allocation, which is exactly the kind of compounding risk the audit exists to catch.

Lesson 117.4 — The Concentration and Margin Check: Sector Limits and Leverage Discipline

Two of the most dangerous risks in NEPSE investing are also two of the easiest to drift into without noticing: sector concentration and margin lending. Both deserve their own dedicated stage in the Canon Audit, because both tend to build up slowly, quietly, and often for entirely innocent reasons, exactly like water pressure building behind a dam wall that looks fine from the outside.

Sector concentration limits, introduced earlier in this Canon, are simply a rule you set for yourself capping how much of your total portfolio can sit in any single sector, such as commercial banks, hydropower, life insurance, or microfinance. The reasoning behind this rule is straightforward. Nepal's economy and its stock market are both still relatively small and concentrated, and entire sectors can move together for reasons that have nothing to do with any individual company's quality. When NRB tightens capital adequacy requirements, every commercial bank stock can fall together. When monsoon rainfall is poor or a major transmission line project is delayed, every hydropower stock can fall together. An investor who is unknowingly eighty percent concentrated in one such sector is not really diversified at all, no matter how many different company names appear in the demat account.

Continuing Sunita's 2080 audit, this is exactly where her earlier hydropower finding turned out to be more serious than it first appeared. Recall she had found three unresearched hydropower purchases across three months. When she pulled her quarterly portfolio snapshots, as described in Lesson 117.2, she saw the following picture. At the start of the year, her hydropower allocation sat at eleven percent of her total portfolio, comfortably within her constitution's fifteen percent sector cap. By her third-quarter snapshot, after the three unresearched purchases and after strong price appreciation in the names she already held, her hydropower allocation had risen to twenty-three percent, well above her own limit. And because the sector had been rallying, it did not feel like a problem. It felt like success. This is precisely the trap: a breach of a concentration limit caused by price appreciation feels good in the moment and is therefore the hardest kind of breach to notice without a scheduled audit.

The margin lending check follows the same logic and deserves equal seriousness, arguably more, because margin lending, where an investor borrows against the value of shares already held in order to buy more shares, is a leverage tool that can turn an ordinary bad year into a devastating one. NRB sets rules on how much banks and finance companies can lend against share collateral, and these rules change from time to time, which is one more reason the regulatory tracker checked in the next lesson matters. But regardless of what NRB currently permits at the system level, your own investment constitution should set a personal ceiling well inside the regulatory limit, because the regulatory limit is the maximum the system allows, not a recommendation for how much any individual investor should actually use.

Sunita's margin check that year turned out clean; she had not used margin lending at all in 2080, having decided two years earlier, after a smaller scare, that margin lending simply did not suit her temperament. This is worth noting precisely because it shows the audit is not designed to always produce bad news. Some areas will pass cleanly, and confirming that is just as valuable as finding the problems, because it tells you where your existing safeguards are holding and do not need new rules layered on top of them.

Having found the sector concentration breach, Sunita's next task was corrective action, not self-punishment. She trimmed her hydropower holdings back down to just under her fifteen percent cap over the following two months, selling first the two positions she had bought without any research, since those were the weakest holdings by her own rule, and keeping the older, researched positions. She did not panic-sell the entire sector, because the audit's finding was about position sizing discipline, not about hydropower being a bad sector to hold at all. This distinction matters. The Canon Audit should always produce a specific, targeted correction tied to the specific rule that was broken, never a broad emotional overreaction that swings the portfolio to some other extreme.

Lesson 117.5 — The Research and Regulatory Habits Check: Library and Tracker Review

The third major area of the Canon Audit turns away from portfolio numbers and toward habits: specifically, the health of your research library and the currency of your regulatory tracker. These two tools, introduced earlier in this Canon, are the quiet infrastructure behind every good investment decision, and like any infrastructure, they decay silently if not maintained. A water tank on a rooftop does not announce that it has developed a slow leak. You only discover it when you notice the water bill climbing or, worse, when the tank runs dry exactly when you need it most.

Your research library, recall, is your organised personal collection of annual reports, quarterly disclosures, prospectuses, and management commentary for the companies you hold or are considering. A healthy research library grows steadily through the year: as each company you hold publishes its quarterly results, you read them and file them. An unhealthy one has gaps, sometimes gaps you do not notice until you go looking for a specific document and cannot find it, or worse, realise you never downloaded it at all.

The audit question here is straightforward: for every company held for more than one quarter during the year, does the reading log show that quarter's report was actually reviewed. Sunita's 2080 audit, continuing the theme from the previous two lessons, found exactly the gap you would expect. Her reading log showed strong coverage for the eight companies she had held for several years, the ones she considered her core, long-term positions. But for the three hydropower names bought impulsively that year, the coverage was zero, confirming again, from a different angle, the same underlying weakness the constitution check had already surfaced. This is a useful pattern to watch for in your own audits: genuine weaknesses tend to show up in more than one exhibit, because a real behavioural gap leaves fingerprints across several different records, not just one.

The regulatory tracker check works similarly but looks outward rather than inward, at the rules of the system you are investing within rather than at your own portfolio. Over the course of any given year, NRB typically issues its monetary policy statement along with periodic directives affecting bank capital requirements, interest rate spreads, and margin lending limits. SEBON, meanwhile, issues directives on matters like IPO share allotment procedures, insider trading disclosure requirements, broker conduct, and listing requirements for new companies. An investor holding bank shares who has not tracked NRB's latest capital adequacy directive, or an investor participating in IPOs who has not tracked SEBON's latest allotment rule changes, is investing with an outdated map of the terrain.

Sunita keeps her regulatory tracker as a simple running log: date, source, either NRB or SEBON, a one-line summary of the change, and a note on whether it affects any of her current holdings. Checking it for currency simply means looking at the dates and asking whether there is a long unexplained gap. In 2080, her tracker showed regular updates through the first two quarters, then a gap of nearly five months with no entries at all, precisely overlapping with the period she was also busiest at her engineering firm on a major project deadline. This was not a coincidence, and recognising that connection turned out to be one of the more useful outcomes of that year's audit, because it told her something about her own limits: when her professional workload spikes, her investing discipline is the first thing to slip, and it slips quietly, without her noticing in the moment.

This finding led to a specific, practical corrective action, distinct from the sector trimming discussed in the previous lesson. Rather than trying to will herself into being equally attentive every month regardless of work pressure, which she recognised as unrealistic, Sunita instead built a lighter-weight backup habit: a recurring reminder on the first Saturday of every month to spend just thirty minutes reading whatever NRB and SEBON had published that month, regardless of how busy work was. Thirty minutes is a small enough commitment to survive even a demanding month, and it prevents the kind of five-month total gap that a more ambitious but fragile habit had allowed.

One further dimension belongs in this stage of the audit: record-keeping completeness itself, which is really a check on whether your entire evidence-gathering system from Lesson 117.2 functioned properly all year, not just at the two moments already discussed. Ask directly: were there any months where you simply stopped logging transactions with reasons, stopped updating the data pipeline, or let the demat statements pile up unopened. Sunita's answer that year was that her transaction ledger had, in fact, stayed current throughout, which was a genuine pass, and worth noting as a pass rather than assuming everything must have failed simply because two other areas had. An honest audit records passes as carefully as it records failures, because an inflated sense of total failure is just as inaccurate, and just as unhelpful for planning next year's corrections, as an inflated sense of total success.

Lesson 117.6 — Scoring the Year: Canon Score, Corrective Action, and Setting Next Year's Targets

The final stage of the Canon Audit brings everything from the previous four lessons together into a single number, the canon score, a concept introduced earlier in this book as a simple, personal measure of how closely your actual investing behaviour matched your own stated principles over a given period. The canon score is not a market performance metric. It says nothing about whether your portfolio beat NEPSE's index that year. It says only how disciplined you were, which, as argued in Lesson 117.3, is the thing that actually determines whether you survive and compound successfully across many years rather than just one.

Calculating a canon score does not require complicated mathematics. Sunita's method, which works well for most individual investors, is to score each of the major areas covered by this chapter, constitution compliance, sector concentration discipline, margin lending discipline, research library health, regulatory tracker currency, and record-keeping completeness, on a simple one-to-five scale, with five meaning fully maintained all year and one meaning essentially abandoned. These six area scores are then averaged into a single overall canon score out of five for the year.

For 2080, Sunita's six scores worked out to: constitution compliance, four out of five, given the one clear breach; sector concentration, three out of five, given the confirmed breach that lasted roughly two quarters before correction; margin lending, five out of five, since she had not used margin at all; research library, three out of five, reflecting the specific gap in the three hydropower names against otherwise strong coverage; regulatory tracker, three out of five, reflecting the five-month gap; and record-keeping, five out of five. Averaged, this produced an overall canon score of just under four out of five for that year, a solid but not perfect result, and one that told a clear, specific story rather than a vague feeling of having done "pretty well, I think."

The number itself, however, is the least important output of the audit. What matters far more is the specific, written corrective plan for the year ahead, built directly from the findings. Sunita's plan following the 2080 audit had three concrete items, each tied to a specific finding rather than a vague resolution. First, a hard rule addition to her constitution: no purchase in any sector already representing more than ten percent of portfolio value without a mandatory two-day cooling-off period and a completed reading log entry, closing the exact loophole that had allowed the unresearched hydropower purchases. Second, the monthly thirty-minute regulatory reading reminder described in Lesson 117.5, specifically designed to survive busy work periods. Third, a mid-year checkpoint, a lighter, thirty-minute version of the full annual audit performed at the Nepali mid-year point, roughly around Kartik, specifically to catch sector concentration drift earlier than a once-a-year check would allow, since that particular breach had been allowed to run for two full quarters before the annual audit caught it.

It is worth being honest about what the Canon Audit cannot do. It cannot predict the market. It cannot guarantee that following every rule perfectly will produce good returns in any given year, because NEPSE, like any market, is subject to forces well beyond any individual investor's discipline: NRB monetary policy shifts, remittance inflow trends, monsoon-dependent hydropower output, global commodity prices affecting import-heavy sectors, and simple crowd psychology among thousands of other retail investors. What the audit can do, reliably, is ensure that when a bad year does come, and eventually one will, it finds an investor who was not also carrying unnecessary self-inflicted risk on top of ordinary market risk. Sunita's correction of her sector concentration in 2080 meant that when hydropower sentiment cooled sharply the following year, her portfolio absorbed a much smaller shock than it would have if the twenty-three percent concentration had been left standing.

A final, practical point on timing and ritual. Sunita chose Baisakh 1, the Nepali new year, deliberately, because it is a date already culturally marked as a moment of renewal and fresh starts, making it psychologically easier to sit down and look honestly at the past year's mistakes than an arbitrary date would be. Some investors may prefer their birthday, the anniversary of opening their first demat account, or the start of the Nepali fiscal year in Shrawan. The specific date matters far less than the fact that it is fixed, recurring, and treated as non-negotiable, exactly like the annual health checkup it was compared to at the start of this chapter. An audit that only happens "when I get around to it" will, for most people, simply never happen, because there is always something more urgent competing for a Saturday afternoon than a quiet, sometimes uncomfortable review of your own mistakes.

The Canon Audit closes each year not with judgment but with renewal: a scored year filed away as a reference point, a short list of specific corrections carried forward, and a fresh copy of the investment constitution ready to be tested again over the twelve months ahead. Sunita now has nine years of these audits filed in one folder, and rereading the earliest ones, she says, is humbling in a useful way. The mistakes of her fourth year as an investor look almost naive to her now. But she is quick to add that this is exactly the point. The audit is not there to make her feel clever about how far she has come. It is there to make sure the mistakes of this year get caught before they can compound into a genuinely damaging one, the way the sector concentration breach was caught and corrected long before it had the chance to combine with a genuine sector downturn.