Quick answer

An employer may investigate suspected employee fraud or falsified records and may impose discipline—including dismissal—if the charge is proved by substantial evidence and constitutes a just cause under the Labor Code or a valid company rule. But suspicion, an audit discrepancy, document access, or an accusation alone is not enough.

Before dismissing the employee, the employer should:

preserve and verify the original records;
identify the employee’s specific act, role, and connection to the irregularity;
issue a detailed written notice to explain;
allow at least five calendar days for a meaningful response;
give a genuine opportunity to present evidence and answer disputed facts;
assess the evidence impartially; and
issue a separate written decision explaining the findings and penalty.

The controlling distinction is important: substantive due process requires a valid and adequately proved ground, while procedural due process requires proper notice and a meaningful opportunity to be heard. A procedurally flawless investigation cannot cure the absence of proof. Conversely, a dismissal supported by just cause may remain valid despite a procedural defect, but the employer may become liable for nominal damages.

What conduct may justify discipline or dismissal?

Article 297 of the Labor Code permits dismissal for, among other grounds:

serious misconduct;
fraud or willful breach of the trust reposed in the employee;
gross and habitual neglect of duties;
willful disobedience of a lawful, reasonable, and work-related order; or
another cause analogous to those specifically listed.

Falsifying, altering, fabricating, concealing, or knowingly submitting false business records may fall under fraud, serious misconduct, or willful breach of trust. Examples may include deliberately falsifying:

expense reports, receipts, or reimbursement documents;
payroll, attendance, overtime, or leave records;
inventory, warehouse, delivery, or receiving records;
invoices, purchase orders, quotations, or payment documents;
sales, collection, or customer records;
quality-control, safety, compliance, or production reports;
credentials, licenses, medical certificates, or employment documents; or
electronic logs and approvals.

The label placed on the charge does not control. The employer must establish the acts actually committed and show how those acts satisfy the elements of the invoked ground.

An innocent encoding error, an ambiguous instruction, a system defect, or a record changed by someone else is not automatically fraud. Fraud ordinarily involves intentional deception or bad faith. The surrounding facts—including the employee’s duties, access, motive, explanation, approval process, and the reliability of the records—must be examined.

What must the employer prove?

In an illegal-dismissal dispute, the employer bears the burden of proving a valid cause for dismissal. The applicable evidentiary standard in labor proceedings is generally substantial evidence: relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

This is less demanding than proof beyond reasonable doubt, but it still requires more than speculation, rumor, or an unsupported accusation.

A sound investigation should answer at least the following questions:

What exact entry, document, transaction, or representation was allegedly false?
What was the accurate information?
Who created, altered, submitted, approved, or benefited from the disputed record?
When and how was the alteration made?
Who had access to the document, account, device, password, or system?
Does the evidence establish intent, or could the discrepancy have resulted from mistake, unclear instructions, shared credentials, or a system problem?
Was the employee responsible for verifying the information?
Is there a documented company rule, employment duty, or established procedure covering the conduct?
Were comparable violations treated consistently?
Is dismissal proportionate to the employee’s actual conduct?

In Perez v. Philippine Telegraph and Telephone Company, the Supreme Court rejected a dismissal for alleged falsification because the employer failed to connect the employees adequately to the tampered documents. The fact that documents had passed through their hands did not prove that they made the alterations, particularly where other personnel could have accessed them. The decision underscores why an employer must establish the chain of custody, employee functions, document-handling process, and actual link between the accused employee and the irregularity. See the Supreme Court decision in Perez v. PT&T.

Fraud and loss of trust are related but not interchangeable

Fraud or willful breach of trust may justify dismissal, but “loss of confidence” cannot merely be asserted after management has decided to remove an employee.

For loss of trust and confidence to support dismissal:

the employee must occupy a position of trust and confidence; and
there must be a willful act that justifies the loss of trust.

Positions of trust commonly include:

managerial employees who formulate or implement management policies; and
rank-and-file employees who regularly handle significant money, property, or sensitive records, such as cashiers, auditors, property custodians, or similar fiduciary personnel.

The degree of proof may be assessed in light of the employee’s position, but the employer must still present substantial evidence of an actual, work-related basis for the loss of trust. It cannot be simulated, arbitrary, or used to disguise an improper reason for dismissal.

Even where an employee supervises the area in which fraud occurred, supervisory responsibility alone does not automatically prove participation. The employer must distinguish among direct falsification, knowing approval, deliberate concealment, grossly negligent oversight, and mere failure to discover another person’s scheme.

A defensible investigation process

1. Secure the evidence without altering it

As soon as a credible irregularity is reported, preserve the relevant materials. Depending on the case, these may include:

original paper records and authenticated copies;
document versions, metadata, audit trails, and access logs;
emails, work messages, and approval histories;
accounting entries and supporting documents;
CCTV recordings covered by a lawful workplace policy;
system-generated reports and administrator logs;
inventory counts, delivery records, and bank confirmations;
written policies, job descriptions, and approval matrices; and
witness statements based on personal knowledge.

Do not overwrite files, annotate original documents, reset relevant devices, or allow automatic retention periods to delete material evidence. Record who collected each item, when it was collected, where it came from, and who subsequently handled it.

For electronic evidence, preserve the original source and export records in a manner that retains dates, account identifiers, and audit information. Screenshots can be useful, but they may be weaker if the underlying record and its context are unavailable.

2. Define the allegation before interviewing the employee

The investigation should begin with a specific theory grounded in identifiable records—not a broad search for anything that might justify dismissal.

Separate:

established facts;
disputed facts;
reasonable inferences;
hearsay or unverified allegations; and
matters requiring technical validation.

If an auditor, forensic specialist, or information-technology officer prepared a report, the investigator should understand the methodology, source data, limitations, and whether alternative explanations were considered.

3. Check the governing documents

Review the employee’s:

employment contract;
job description;
code of conduct;
disciplinary schedule;
confidentiality and information-security policies;
collective bargaining agreement, if applicable;
applicable past practices; and
acknowledgments of company policies.

A company rule used as a basis for discipline should be reasonable, lawful, known or properly communicated to employees, and applied fairly.

4. Issue a specific first notice

If dismissal is being considered, the first written notice—often called a notice to explain—should state:

the particular acts or omissions charged;
relevant dates, transactions, amounts, documents, and locations;
the employee’s alleged participation;
the company rules and Labor Code grounds potentially violated;
the material evidence supporting the charge, or how it may be reviewed;
that dismissal is among the possible consequences, if true;
the deadline for the written explanation; and
the employee’s opportunity to submit evidence and obtain representation.

A vague notice such as “explain the anomalies” or “loss of trust due to falsification” may not permit a meaningful defense. Charges should not materially change after the employee responds without a supplemental notice and another fair opportunity to answer.

Under DOLE Department Order No. 147-15, a reasonable opportunity generally means at least five calendar days from receipt of the first notice. More time may be appropriate when the records are voluminous, the allegations are complex, or essential evidence is not immediately accessible.

5. Prove service and receipt

Use a method that can later establish when and how the notice was served. Personal service with a signed acknowledgment is ordinarily clearest. If the employee refuses to receive or sign, document the attempt through witnesses and use another reliable method consistent with company rules, such as service at the employee’s last known address.

Electronic delivery may supplement service where the employer can reliably prove receipt, but sending an email without proof that it reached the employee may create an avoidable dispute.

6. Give a genuine opportunity to respond

The employee should be allowed to:

submit a written explanation;
inspect or obtain material records reasonably necessary for the defense, subject to lawful confidentiality safeguards;
identify witnesses and provide supporting documents;
explain technical or accounting entries;
point out other persons with access or approval authority;
request a reasonable extension when justified; and
obtain assistance from a representative or counsel if desired.

The employer need not conduct a courtroom-style trial. Under Perez v. PT&T, a meaningful written opportunity can satisfy the hearing requirement. However, a conference or hearing becomes particularly important when:

the employee requests one in writing;
material facts or document authenticity are seriously disputed;
credibility must be assessed;
company rules or established practice require a hearing; or
the case cannot fairly be resolved through written submissions alone.

If a conference is held, prepare accurate minutes. Identify the attendees, issues discussed, evidence presented, questions asked, and requests made. Let the employee review the minutes or submit written corrections. Do not convert an investigation meeting into a demand for an immediate confession or resignation.

7. Investigate both incriminating and exculpatory evidence

The investigator should not simply build a case for a predetermined result. Check defenses that can objectively be verified, including:

shared usernames or passwords;
delegated data entry;
supervisor instructions;
automatic system entries;
duplicate or reversed transactions;
document templates carrying old information;
later alterations by another user;
emergency workarounds previously tolerated by management; and
evidence that the employee reported or attempted to correct the discrepancy.

Witness statements should identify what each witness personally saw, heard, did, or verified. Anonymous reports may justify a preliminary inquiry but ordinarily require corroboration before being treated as proof of guilt.

8. Make findings charge by charge

The decision-maker should determine separately whether each charge is:

substantiated;
unsubstantiated; or
supported only in part.

The written evaluation should explain why particular evidence was accepted or rejected. It should also address the employee’s material defenses rather than merely stating that the explanation was “unsatisfactory.”

The decision-maker should avoid relying on evidence never disclosed in substance to the employee when that evidence is material to the outcome. If significant new evidence emerges, fairness ordinarily calls for a supplemental notice or further opportunity to respond.

9. Determine the proper penalty

Even when an infraction is proved, dismissal is not automatic. Consider:

the employee’s intent and participation;
the nature and importance of the record;
actual or potential loss;
concealment or attempted cover-up;
the employee’s position and fiduciary duties;
prior offenses, if validly documented and relevant;
whether the conduct destroyed the trust essential to the job;
consistency with penalties imposed in comparable cases; and
mitigating circumstances.

A first offense involving deliberate fraud or falsification may be serious enough to justify dismissal, especially where honesty is indispensable to the employee’s duties. But management must still establish the willful act and explain why a lesser penalty would be inadequate.

10. Issue a separate written decision

After considering the employee’s explanation and the complete investigation record, issue a second written notice stating:

the findings of fact;
the evidence relied upon;
the material defenses considered;
the rule and legal ground established;
the penalty imposed; and
the effectivity date of dismissal, if applicable.

Do not prepare or date the final decision in a manner showing that the result was fixed before the response period or hearing ended.

Preventive suspension during the investigation

Preventive suspension is not an automatic step and is not itself a penalty. It may be imposed only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers.

In a fraud or falsification investigation, a justified threat might involve a demonstrated ability to alter records, intimidate witnesses, interfere with systems, or remove company property. The employer should document the specific risk; the seriousness of the accusation alone is not enough.

Preventive suspension generally cannot exceed 30 days. After that period, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the wages and benefits due during the extension. The Supreme Court discusses these safeguards in Lagamayo v. Cullinan Group, Inc..

A preventive-suspension notice should be kept distinct from the notice to explain unless the combined document clearly satisfies every requirement of both measures.

Data privacy and workplace monitoring

Investigating employee fraud often involves processing personal data. The employer must comply with the Data Privacy Act of 2012, including the principles of transparency, legitimate purpose, and proportionality.

The National Privacy Commission recognizes that employers may have legitimate interests in enforcing company policies, protecting assets, and preventing misconduct. That does not permit unlimited surveillance or indiscriminate collection. The processing should have a lawful basis, be necessary for the stated purpose, and avoid collecting information excessive to the investigation.

Employees should ordinarily be informed through workplace policies of the nature, purpose, scope, and method of monitoring. Access to investigation records should be limited to persons with a legitimate role, and irrelevant personal information should not be circulated. The NPC’s discussion of employee monitoring and legitimate interests appears in Advisory Opinion No. 2024-003.

CCTV use must likewise comply with applicable privacy requirements, including the NPC’s rules on CCTV systems.

Employers should be especially cautious about secretly recording private conversations, demanding access to personal accounts, or searching personal devices without a clear lawful basis. The fact that an investigation concerns fraud does not suspend privacy, communications, cybersecurity, or criminal laws.

Does the employer need a criminal conviction?

No. An internal disciplinary case, an illegal-dismissal case, and a criminal prosecution are separate proceedings.

An employer need not wait for a criminal conviction before deciding an administrative case. Labor disputes generally apply the substantial-evidence standard, while a criminal conviction requires proof beyond reasonable doubt. Accordingly:

dismissal is not automatically valid merely because a criminal complaint was filed;
dismissal is not automatically invalid merely because prosecutors declined to file charges or a criminal case ended in acquittal; and
the employer must independently prove the employment ground relied upon.

A police report, affidavit, or criminal complaint may be part of the evidence, but filing one does not establish guilt.

If criminal referral is being considered, both sides should obtain legal advice before giving sworn statements, surrendering personal devices, or signing admissions or settlement documents.

If the employee refuses to answer or attend

An employee cannot necessarily stop the process by ignoring a properly served notice. If the employer has:

served a sufficiently specific charge;
allowed a reasonable response period;
provided a meaningful opportunity to answer; and
documented the employee’s refusal or failure to participate,

the employer may decide the case on the available evidence. Silence, however, does not relieve the employer of proving the charge. It should not automatically be treated as an admission.

The final notice must still explain the findings and decision.

If the employee admits the falsification

An admission is important evidence, but the employer should still verify:

whether it was voluntary;
exactly what conduct was admitted;
whether the employee understood the document signed;
whether the admission was qualified or taken out of context; and
whether the admitted act legally and proportionately warrants the penalty imposed.

Avoid forcing an employee to sign a prewritten confession, resignation, quitclaim, or promissory note as a condition for being heard. A resignation obtained through intimidation, deception, or unbearable pressure may later be challenged as involuntary or constructive dismissal.

Repayment of a shortage does not necessarily erase an employment violation, but neither does repayment by itself prove fraudulent intent.

Consequences of getting the process wrong

No valid cause was proved

If the employer fails to prove a just cause, the dismissal is illegal. Depending on the case, the employee may be entitled to reinstatement without loss of seniority rights, full backwages, benefits, or separation pay in lieu of reinstatement.

This can occur even when the employer completed the twin notices, because procedure cannot substitute for proof.

Valid cause existed, but procedure was defective

Under Agabon v. NLRC, dismissal for a proved just cause is not automatically invalidated solely by failure to observe statutory procedure. The employer may nevertheless be ordered to pay nominal damages for violating the employee’s statutory due-process rights. The commonly applied benchmark for a just-cause dismissal is ₱30,000, subject to the controlling jurisprudence and circumstances of the case.

Improper preventive suspension

If preventive suspension lacked the required serious and imminent threat, or continued beyond the permissible unpaid period, the employer may face liability for wages and other remedies applicable to the facts.

Mishandling personal data or evidence

Excessive monitoring, unauthorized disclosure, unlawful access, evidence alteration, or careless retention may create separate privacy, civil, criminal, regulatory, or evidentiary problems.

Evidence the employer should preserve

Keep an organized investigation file containing:

the original complaint or incident report;
documented authority of the investigator;
original and preserved copies of disputed records;
audit trails, metadata, and access logs;
relevant policies and proof that they were communicated;
job descriptions and approval workflows;
witness statements and interview notes;
the audit or forensic report and underlying data;
notices, proofs of service, and employee responses;
extension requests and rulings;
hearing invitations, minutes, and submitted evidence;
the written evaluation and decision; and
records showing how comparable cases were handled.

Retention and access should follow lawful business, litigation-hold, and data-privacy requirements.

Evidence the employee should preserve

An employee facing a fraud or falsification charge should safely retain lawful copies of:

the notice to explain and proof of receipt date;
the employment contract, job description, and applicable policies;
the disputed records and available version histories;
emails or messages showing instructions and approvals;
evidence of shared access, system errors, or delegated work;
prior reports made about the discrepancy;
the written explanation and proof of submission;
requests for evidence, extensions, or a hearing;
hearing minutes and objections to inaccuracies;
the preventive-suspension and dismissal notices; and
payslips and employment records relevant to possible claims.

Do not destroy, alter, secretly remove, or publicly disclose company records. Preserve only material that may lawfully be possessed, and seek legal advice where documents contain confidential or third-party information.

Common mistakes

Employers commonly weaken otherwise legitimate cases by:

treating an audit variance as conclusive proof of fraud;
assuming that access means authorship;
failing to identify who else could alter the record;
issuing a vague notice or changing the charge midway;
giving less than five calendar days to explain;
withholding material information needed for a defense;
refusing a hearing despite serious factual disputes;
relying entirely on anonymous accusations;
making the investigator, accuser, and final decision-maker indistinguishable without safeguards against bias;
imposing preventive suspension without documenting an imminent threat;
extending unpaid preventive suspension beyond 30 days;
deciding the penalty before receiving the employee’s explanation;
using a forced resignation instead of completing due process; or
disclosing accusations broadly inside or outside the company.

Employees commonly harm their position by:

ignoring the notice;
responding only with a general denial;
failing to request missing records or a reasonable extension in writing;
altering, deleting, or taking confidential evidence;
confronting or threatening witnesses;
signing an inaccurate admission or resignation under pressure without recording an objection; or
assuming that absence of a criminal conviction automatically defeats the employment case.

When legal help is urgent

Prompt legal advice is particularly important when:

dismissal or an immediate decision deadline is involved;
the employee has been asked to sign an admission, resignation, quitclaim, or repayment undertaking;
electronic evidence may soon be deleted or overwritten;
records involve regulated financial, health, government, or customer information;
personal devices, private accounts, covert recordings, or extensive surveillance are involved;
a criminal complaint, subpoena, search, or police investigation is possible;
the employee is a union officer, whistleblower, data-protection officer, or member of a protected group;
several employees had shared access to the disputed system;
the suspension is approaching 30 days;
retaliation, evidence tampering, or witness intimidation is alleged; or
company management may itself be implicated.

Challenging a dismissal

An employee may contest the validity of a dismissal through the labor-dispute process. Most labor and employment disputes first undergo mandatory conciliation-mediation under the Single Entry Approach, subject to legal exceptions. A request for assistance may be filed through DOLE’s Assistance for Request Management System or at an appropriate DOLE, National Conciliation and Mediation Board, or National Labor Relations Commission office. The statutory basis for mandatory conciliation is Republic Act No. 10396.

Do not delay merely because an internal appeal, criminal investigation, or settlement discussion is pending. Different claims may have different prescriptive periods, and the correct forum can depend on the employee’s status, the relief requested, and any applicable collective bargaining agreement.

Frequently asked questions

Can an employee be dismissed for falsifying one record?

Possibly. A single deliberate falsification may justify dismissal when it constitutes serious misconduct, fraud, or willful breach of an essential trust. The employer must still prove the employee’s responsibility and fraudulent or willful conduct, observe due process, and show that dismissal is proportionate.

Is an audit report enough?

Not necessarily. An audit report may establish discrepancies, but the employer must connect the employee to the false entry or transaction. The report’s sources, methodology, access controls, and alternative explanations should be examined.

Must the employer provide every confidential document?

Not automatically. But the employee must receive enough specific information and meaningful access to material evidence to answer the charge. Legitimate confidentiality concerns may be addressed through redaction, supervised inspection, or limited disclosure rather than complete denial.

Is a formal hearing always required?

No courtroom-style hearing is universally required. A meaningful written opportunity may suffice. A conference or hearing should be held when the employee requests one in writing, material facts are substantially disputed, company rules require it, or similar circumstances make it necessary for fairness.

Can the employee bring a lawyer?

The employee may seek assistance from a representative or counsel. An internal proceeding is not a criminal trial, but the employer should not deny reasonable representation where the law, applicable rules, company procedure, or the circumstances call for it.

Can the employer suspend the employee while investigating?

Only when continued employment poses a serious and imminent threat to life or property. Preventive suspension is not a punishment and generally cannot remain unpaid beyond 30 days.

Can the employer dismiss the employee while a criminal case is pending?

Yes, if the employer independently establishes a just cause through substantial evidence and follows procedural due process. Filing a criminal case alone is not proof of the employment charge.

Does refusal to sign the notice stop the case?

No. The employer may document the refusal and use a reliable alternative method of service. What matters is whether the employer can prove that the employee was properly informed and given a fair opportunity to respond.

Can an employer announce that the employee committed fraud?

Public or unnecessary internal accusations should be avoided. Investigation information should be shared only with persons who have a legitimate need to know. Premature or excessive disclosure may create privacy, reputational, or other legal exposure.

What if the employee was only following a supervisor’s instruction?

That is a material fact, not an automatic defense or automatic admission. The investigation should determine what was ordered, whether the employee knew the act was false or unlawful, whether there was an opportunity to object, and who participated in or approved the transaction.

Official legal sources

This article provides general Philippine legal information, not advice for a specific investigation or employment dispute. Outcomes depend on the evidence, employment documents, company rules, and procedural history. Law and official guidance checked as of August 24, 2026.