Quick answer

An employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. For a lawful termination in the private sector, the employer must establish both:

A valid substantive ground, supported by substantial evidence—such as fraud or a willful breach of trust under Article 297(c) of the Labor Code, serious misconduct, or another applicable just cause; and
Procedural due process—a specific written charge, a meaningful opportunity to answer and present evidence, fair consideration of the defense, and a written decision.

Falsifying a document is not automatically a lawful ground for dismissal in every case. The employer must determine who made or authorized the entry, whether it was deliberate, how it related to the employee’s duties, what rule or trust was violated, and whether dismissal is justified under the circumstances.

These rules generally concern private-sector employment. Government employees are governed principally by civil-service laws and disciplinary rules, while a collective bargaining agreement, employment contract, or valid company policy may provide additional protections.

What the employer must prove

Article 297 of the Labor Code recognizes fraud or willful breach of the employer’s trust as a just cause for termination. Depending on the facts, falsification may also be evaluated as serious misconduct or a cause analogous to the statutory grounds.

For fraud or loss of trust to support dismissal, the employer should be able to prove:

The employee committed or knowingly participated in a specific dishonest act;
The act was intentional, knowing, and purposeful—not merely careless or inadvertent;
The employee occupied a position in which the relevant trust was actually reposed;
The conduct had a real connection to the employee’s work, responsibilities, access, or fiduciary duties; and
The loss of trust rests on substantial evidence, not rumor, speculation, or a predetermined conclusion.

The Supreme Court distinguishes between managerial employees and rank-and-file employees who regularly handle significant money or property, such as cashiers, auditors, and property custodians. An employer cannot simply label every employee a “position of trust.” The employee’s actual duties and access matter. See Jalit v. Cargo Safeway, Inc..

“Substantial evidence” means relevant evidence that a reasonable mind might accept as adequate to support a conclusion. It is lower than proof beyond reasonable doubt, but it still requires more than an accusation. In Gomez v. Crossworld Marine Services, Inc., the Supreme Court stressed that loss of confidence must be genuine and must not be used as a cover for an improper or unjustified dismissal.

A fair investigation, step by step

1. Secure the records without declaring guilt

Preserve the relevant originals and reliable copies before records can be altered or lost. Depending on the allegation, these may include:

Payroll, attendance, timekeeping, expense, inventory, sales, or accounting records;
Original forms and their revision histories;
Emails, work messages, approval logs, and system audit trails;
Access-control, CCTV, device, or login records lawfully maintained by the company;
Applicable policies, manuals, job descriptions, and acknowledgment forms;
Transaction documents and specimen signatures; and
Statements from witnesses with personal knowledge.

Record when, where, and from whom each item was obtained. Preserve metadata and export logs in a reliable format where possible. Do not edit an original file merely to highlight suspected changes; work from a copy and retain the original.

Access should be limited to people who genuinely need the information. Investigators should avoid unnecessary disclosure of accusations or personal information and should follow applicable privacy, cybersecurity, retention, and company policies.

2. Identify the precise allegation

The investigator should separate verified facts from assumptions. Useful questions include:

What exact entry, signature, amount, date, approval, or document is disputed?
Who created, changed, submitted, approved, or benefited from it?
What system or procedure was supposed to be followed?
Could the discrepancy have resulted from an input error, delegated access, system failure, unclear instruction, or later alteration by another person?
What policy or statutory ground may apply?
Is there evidence of intent, knowledge, concealment, or personal benefit?

A discrepancy is not necessarily fraud. Intent should be inferred only from reliable facts, such as repeated manipulation, false supporting documents, concealment, inconsistent explanations, unauthorized credentials, or a demonstrated connection between the employee and the disputed transaction.

3. Conduct neutral fact-finding

Interview witnesses separately where practical. Ask open questions first and follow up with the documents. A witness statement is stronger when it identifies what the witness personally saw, heard, created, or received.

Unverified hearsay may be too weak to support dismissal, particularly where the employer could have obtained direct evidence. In Libcap Marketing Corp. v. Baquial, the Court rejected fraud-related accusations that lacked specific acts and substantial supporting evidence.

The person investigating should not promise a particular outcome. If someone involved in the alleged loss is also the investigator or final decision-maker, consider assigning an independent reviewer to reduce bias and preserve confidence in the process.

4. Issue a specific first written notice

If the evidence reasonably points to an employee, serve a written notice to explain. Under DOLE Department Order No. 147-15, the first notice should contain:

The specific just cause or causes being considered under Article 297;
The company rule allegedly violated, if any;
A detailed account of the acts, dates, transactions, documents, and circumstances supporting the charge;
Enough information for the employee to understand and answer the accusation; and
A direction to submit a written explanation within a reasonable period.

A “reasonable period” means at least five calendar days from receipt of the notice. This allows the employee to study the accusation, consult a lawyer or union officer, gather evidence, and prepare a defense. The Supreme Court applied this standard in Bicol Isarog Transport System, Inc. v. Relucio.

The notice should not merely say “fraud,” “dishonesty,” or “falsification.” It should identify the particular record and conduct involved. A vague charge undermines the employee’s ability to defend against it.

Serve the notices personally or at the employee’s last known address, and retain reliable proof of service. If the investigation later uncovers a materially different accusation, give the employee a new or supplemental notice and another fair opportunity to respond. The final decision should not rely on an uncharged incident.

5. Give a meaningful opportunity to answer

The employee must be allowed to submit an explanation, supporting documents, and relevant witness information. “Ample opportunity to be heard” may be provided in writing, through a conference, or by another fair and reasonable method.

A formal hearing or conference becomes necessary when:

The employee requests one in writing;
There are substantial factual or evidentiary disputes;
A company rule, established practice, or collective bargaining agreement requires it; or
Comparable circumstances make a hearing necessary for fairness.

At a conference, the employee should be allowed to respond to the evidence, explain disputed records, and present supporting material. Assistance by counsel, a union officer, or another representative should be allowed when required by the applicable rules or company agreement.

Due process does not require the employer to adopt every defense. It requires the employer to receive and genuinely consider it before deciding.

6. Evaluate the whole record

The decision-maker should assess inculpatory and exculpatory evidence together. Relevant considerations include:

Reliability and source of each record;
Whether witnesses had personal knowledge;
The employee’s access, authority, and actual duties;
Evidence of intent or an innocent explanation;
Whether credentials could have been shared or misused;
Consistency of the employee’s explanation with system and transaction records;
The seriousness and work connection of the violation;
The employee’s prior record, where lawfully relevant; and
Penalties imposed in comparable cases under the same policy.

A criminal conviction is not required before an employer may impose discipline. An internal labor investigation and a criminal case use different procedures and standards of proof. Conversely, filing a criminal complaint does not by itself prove just cause for dismissal, and dismissal does not establish criminal guilt.

7. Issue a reasoned written decision

If the evidence establishes a lawful ground and dismissal is proportionate, serve a second written notice stating:

The material charge considered;
The employee’s explanation and significant evidence;
The factual findings;
The policy and legal ground applied;
The conclusion that the ground was established after considering the circumstances; and
The effective date and consequence of the decision.

If the evidence does not support dismissal, close the charge or impose only a lawful, proportionate penalty permitted by company rules. Do not characterize a resignation as “voluntary” if it was obtained through coercion, threats, or intolerable working conditions.

Can the employee be preventively suspended?

Preventive suspension is not an automatic response to a fraud allegation and is not itself a disciplinary penalty. It is justified only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers.

An employer should document the specific risk—for example, continuing access to funds, controlled inventory, critical records, or systems that could be altered during the investigation. Less restrictive safeguards, such as temporary reassignment, controlled access, or credential changes, may be appropriate where they adequately address the risk.

Preventive suspension generally may not exceed 30 days. After that, the employee must be reinstated to the former or a substantially equivalent position, or the suspension may be extended with payment of the wages and benefits due during the extension. The Supreme Court explains these limits in Maula v. Ximex Delivery Express, Inc..

If the required serious and imminent threat did not exist, the suspension may be improper and may expose the employer to a claim for unpaid wages or other relief.

What an accused employee should do

An employee who receives a notice to explain should act promptly:

Record the date and method of receipt. The response period runs from receipt.
Read each allegation and identify missing dates, transactions, documents, or policies.
Ask in writing for reasonably necessary particulars or access to records needed to answer.
Preserve relevant emails, lawful copies of work records, schedules, instructions, approvals, and messages.
Prepare a chronological, factual response. Address each charge separately.
Identify records or witnesses that support the explanation.
Explain shared access, system errors, delegated work, unclear instructions, or document-handling practices where genuinely relevant.
Request a conference in writing if material facts are disputed or oral clarification is necessary.
Consult a union representative or labor lawyer before signing an admission, settlement, resignation, or repayment undertaking.

Do not alter, delete, fabricate, or secretly remove confidential company records. Preserve only material that may lawfully be retained, and seek legal advice if access or ownership is disputed.

Silence does not automatically prove guilt, but failing to answer may leave the employer’s evidence unrebutted. If more time is genuinely needed, request a reasonable extension in writing before the deadline and state why.

Common mistakes

Mistakes by employers

Treating an audit discrepancy as conclusive proof of fraud;
Issuing a vague notice with no dates, transactions, or supporting facts;
Allowing fewer than five calendar days to explain;
Deciding the penalty before receiving the employee’s response;
Relying only on unsigned, anonymous, or hearsay accusations when direct evidence is obtainable;
Assuming every employee holds a position of trust;
Using evidence or incidents not identified in the first notice;
Conducting a nominal conference without allowing a real defense;
Extending unpaid preventive suspension beyond 30 days;
Applying inconsistent penalties to comparable cases; or
Forcing a resignation to avoid the twin-notice process.

Mistakes by employees

Ignoring the notice or responding only with a general denial;
Deleting messages or modifying disputed files;
Signing a prepared confession without reading or understanding it;
Assuming an acquittal or dismissed criminal complaint automatically resolves the labor case;
Taking originals or confidential data without authority; or
Waiting too long to challenge a dismissal or seek assistance.

Consequences of getting the process wrong

If there was no just cause or the employer cannot prove it by substantial evidence, the dismissal may be illegal. Depending on the case, the employee may be entitled to reinstatement, backwages, or separation pay in lieu of reinstatement, together with other relief allowed by law.

If a valid just cause existed but the employer failed to observe procedural due process, the dismissal may remain effective, but the employer can be ordered to pay nominal damages for violating the employee’s statutory rights. The result depends on the proven ground, the procedural defect, and controlling jurisprudence.

The employer bears the burden of proving the legality of a challenged dismissal. Internal conclusions, labels, or unsupported allegations do not satisfy that burden.

When legal help is urgent

Seek advice promptly when:

A dismissal, forced resignation, indefinite suspension, or lockout from work has already occurred;
The response deadline is near and the charge involves complex digital or accounting records;
The employee is being asked to confess, repay money, surrender a device, or sign a quitclaim;
The employer plans simultaneous labor, civil, and criminal action;
Evidence may be deleted, overwritten, or removed;
The accusation appears retaliatory, discriminatory, or connected to union activity or whistleblowing;
A collective bargaining agreement provides a grievance or arbitration deadline; or
The parties disagree about access to private communications, devices, or personal data.

Most labor and employment disputes must first undergo mandatory conciliation-mediation under Republic Act No. 10396. A worker or employer may file a Request for Assistance through DOLE’s SEnA/ARMS portal or at an authorized DOLE, NCMB, or NLRC office.

An illegal-dismissal claim generally prescribes in four years from accrual, while covered money claims generally prescribe in three years. Shorter contractual or procedural deadlines may apply to grievances, appeals, or other remedies, so waiting is risky. Current filing information is available from the NLRC and its 2025 Rules of Procedure.

Frequently asked questions

Is falsifying a time record always grounds for dismissal?

No. It may constitute a just cause when deliberate dishonesty is established and the circumstances justify dismissal. The employer must still prove the act, intent, work connection, and applicable ground through substantial evidence and observe due process.

Must the employer show the employee personally benefited?

Not always. Personal gain can be strong evidence, but deliberate falsification intended to mislead the employer may be serious even without proven financial benefit. The complete circumstances remain controlling.

Is an administrative hearing always required?

No. A meaningful written opportunity to answer may be sufficient. A hearing or conference is required when requested by the employee in writing, when substantial evidentiary disputes exist, when company rules or practice require it, or when similar circumstances make it necessary.

May the employer examine company email or system logs?

Potentially, if access is lawful, work-related, proportionate, and consistent with applicable notices, policies, privacy requirements, and security controls. Ownership of the device does not eliminate every privacy concern. Sensitive or personal material should be handled narrowly and securely.

Can the employer dismiss the employee while a criminal case is pending?

The employer need not wait for the criminal case if substantial evidence independently establishes a just cause and due process is observed. The criminal and labor proceedings are separate. A criminal accusation alone is not substantial evidence of an employment violation.

Can the employee bring a lawyer to the conference?

An employee may seek assistance from counsel or a representative. Whether counsel must be present at a particular internal conference can depend on the governing rule, collective bargaining agreement, company policy, and circumstances, but the employer must still provide a meaningful opportunity to defend against the charge.

What if the employee refuses to receive the notices?

The employer should document the attempted service and send the notices to the employee’s last known address using a method that provides reliable proof. Refusal to receive a notice does not permit the employer to dispense with a genuine opportunity to respond.

Does repayment erase the offense?

Not necessarily. Repayment may be relevant to the circumstances or penalty, but it does not automatically eliminate an established fraudulent act. It also should not be treated as an admission unless the surrounding facts support that conclusion.

Official sources

This article provides general Philippine legal information, not legal advice for a particular investigation or dispute. Outcomes depend on the evidence, employment status, company rules, collective bargaining agreement, and other facts. Official sources and current procedures were checked as of August 27, 2026.