Quick answer

An employer may investigate suspected employee fraud or falsified records, secure company property and systems, interview witnesses, and impose discipline. But dismissal is lawful only if both requirements are met:

There is a valid, factually proven just cause under the Labor Code—such as fraud or willful breach of trust, serious misconduct, or another applicable ground; and
The employee receives procedural due process: a detailed first written notice, a meaningful opportunity to answer, and a written decision issued only after the employer fairly considers the evidence and defense.

Suspicion, an unexplained discrepancy, or a general accusation is not enough. In an illegal-dismissal case, the employer must prove the valid cause by substantial evidence, meaning relevant evidence that a reasonable mind could accept as adequate. The employer does not need to prove a crime beyond reasonable doubt in the internal employment case, but it must still connect the employee to the alleged act through reliable evidence.

For private-sector employment, the principal rules are found in Article 297 of the Labor Code, DOLE Department Order No. 147-15, and Supreme Court decisions applying the twin-notice and ample-opportunity-to-be-heard requirements.

What conduct may justify dismissal?

Fraud or falsification can support dismissal, but the legal ground must fit the proven conduct.

Fraud or willful breach of trust

Article 297(c) allows dismissal for fraud or willful breach of the trust placed in an employee by the employer or its authorized representative. Ordinarily, two conditions must concur:

The employee occupies a position of trust and confidence; and
The employee committed an act that justifies the loss of that trust.

Positions of trust generally include:

Managerial employees entrusted with important management decisions or sensitive responsibilities; and
Fiduciary rank-and-file employees—such as cashiers, auditors, property custodians, or employees who regularly handle significant money or property.

The breach must be willful: intentional, knowing, and purposeful, rather than merely careless or inadvertent. Loss of confidence must rest on substantial grounds. It cannot be simulated, asserted as a pretext, or invented after the employer has already decided to remove the employee. The Supreme Court explains these safeguards in Jalit v. PAL Express and Mañebo v. NLRC.

Employees outside a genuine position of trust cannot automatically be dismissed under “loss of trust and confidence.” The same act may nevertheless fall under another just cause if its elements are proven.

Serious misconduct

Falsifying an official record may constitute serious misconduct when the act is:

Serious or grave;
Related to the performance of the employee’s duties;
Done with wrongful intent, rather than through a mere error in judgment; and
Of such character that continued employment has become untenable.

Examples may include intentionally fabricating sales, attendance, expense, inventory, payroll, production, safety, regulatory, medical, or customer records. Whether dismissal is proportionate depends on the employee’s intent, role, prior record, company rules, actual or potential harm, and all surrounding circumstances.

A typo, incomplete entry, mistaken encoding, poor training, defective process, or isolated negligence is not automatically fraud. The employer must investigate whether the entry was deliberately false and whether the employee was responsible for it.

Violation of company rules

A code-of-conduct violation may support discipline when the rule is lawful, reasonable, known or properly communicated to employees, related to the work, and applied consistently. The employer should identify both the Labor Code ground and the specific company rule involved.

A handbook label such as “dishonesty” or “falsification” does not eliminate the need to prove what happened. The employer must allege and establish specific acts, not merely recite a policy category. The Supreme Court emphasized this requirement in Maula v. Ximex Delivery Express.

A lawful investigation, step by step

1. Secure evidence without deciding guilt in advance

As soon as a credible issue appears, the employer should preserve the relevant records. Depending on the case, these may include:

Original paper documents and authenticated copies;
Accounting, point-of-sale, payroll, inventory, access-control, or audit logs;
Emails, work chats, system messages, and authorized CCTV footage;
File metadata, version histories, timestamps, user accounts, and device records;
Approval trails, specimen signatures, transaction documents, and reconciliation reports;
Applicable policies, job descriptions, delegations of authority, and training records;
Witness statements based on personal knowledge; and
Records showing the amount, property, customer, compliance duty, or operation affected.

Preserve originals and document who collected, copied, transferred, examined, or stored each item. Restrict access to persons with a legitimate role in the investigation. Avoid editing original electronic files, relying only on screenshots when native records are available, or allowing an interested witness to control all evidence.

The investigation should test alternative explanations: system errors, shared credentials, duplicate names, supervisor instructions, faulty equipment, unauthorized access, weak controls, or ordinary mistakes.

2. Protect privacy and confidentiality

An internal investigation does not create unlimited authority to search or disclose personal information. Processing must comply with the Data Privacy Act’s principles of transparency, legitimate purpose, and proportionality, as stated in Republic Act No. 10173.

Employers should:

Collect only information reasonably relevant to the suspected violation;
Follow workplace policies governing company accounts, devices, CCTV, and monitoring;
Avoid unnecessary access to purely personal files or communications;
Use secure evidence storage and access logs;
Disclose allegations only to persons who need the information;
Avoid public accusations, office gossip, or premature announcements of guilt; and
Consult the data protection officer when sensitive information, extensive monitoring, or a possible data breach is involved.

Evidence gathered unlawfully or unfairly can create separate privacy, employment, civil, or criminal issues.

3. Identify the exact charge

Before sending a notice to explain, determine what the evidence reasonably indicates. Separate possible offenses instead of using a vague label such as “fraud and other violations.”

For each charge, identify:

The act or omission;
The date, place, transaction, record, account, or system involved;
The employee’s alleged participation;
What was false, altered, concealed, approved, or misrepresented;
The evidence supporting the allegation;
The applicable company rule; and
The possible just cause under Article 297.

Do not charge one offense and later dismiss the employee for a materially different, uncharged offense. An employee cannot meaningfully defend against a ground that was never disclosed. The Supreme Court rejected inconsistent charges and findings in Foodbev International Consulting Corp. v. Eroles.

4. Serve the first written notice

The first notice—often called a notice to explain or show-cause notice—should contain:

A detailed narration of the material facts and circumstances;
The specific charge or charges;
The applicable policy provisions and Labor Code ground;
A statement that dismissal is among the possible consequences, if that is genuinely under consideration;
Instructions on how and where to submit an explanation;
The response deadline; and
Information about any scheduled conference and the employee’s opportunity to submit evidence.

The notice must be specific enough for the employee to prepare an intelligent defense. Avoid conclusions such as “you committed fraud” without identifying the questioned records or transactions.

The employee must ordinarily receive at least five calendar days from receipt of the notice to respond. This period allows the employee to study the accusation, consult a union officer or lawyer, gather records, and prepare a defense. The Supreme Court applies this minimum in King of Kings Transport, Inc. v. Mamac and subsequent cases such as HSBC Electronic Data Processing (Philippines), Inc. v. Cases.

Keep proof of actual service or a properly documented attempt to serve the notice. Email or another agreed channel may supplement service, but the employer should be able to prove when and how the employee received it.

5. Give a meaningful opportunity to answer

The employee may:

Admit or deny each allegation;
Explain errors, instructions, access arrangements, or surrounding circumstances;
Identify records or witnesses that support the defense;
Challenge the authenticity, completeness, context, or interpretation of evidence;
Request relevant information needed to understand the charge;
Ask in writing for a formal conference; and
Consult a union representative or lawyer.

A formal trial-type hearing is not automatically required in every disciplinary case. A meaningful written opportunity may satisfy due process. A conference or hearing becomes necessary when:

The employee requests it in writing;
Substantial evidentiary disputes exist;
Company rules or established practice require it; or
Comparable circumstances make a conference necessary for fairness.

This rule is discussed in Perez v. Philippine Telegraph and Telephone Company.

If a conference is held, give reasonable notice, use an impartial decision-maker where practicable, allow the employee to explain and identify evidence, and prepare accurate minutes. The employer need not use courtroom procedure, but it should not reduce the conference to a formality after guilt has already been predetermined.

Silence or failure to answer does not automatically prove fraud. If the employee received a fair notice and opportunity but declined to participate, the employer may decide using the available evidence—provided that evidence independently establishes the charge.

6. Use preventive suspension only when legally justified

Preventive suspension is not a punishment and should not be automatic in fraud cases. It may be used only when the employee’s continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. For example, continued access to cash, inventory, critical records, or systems may present such a threat if the risk is concrete and documented.

Preventive suspension generally cannot exceed 30 days. After that, the employer must either:

Reinstate the employee to the former or a substantially equivalent position; or
Extend the suspension while paying the employee’s wages and other benefits during the extension.

If dismissal follows, the employee need not reimburse pay received during the extended period. These rules appear in the Omnibus Rules Implementing the Labor Code and are applied in Maula v. Ximex Delivery Express.

A suspension imposed without the required serious and imminent threat may expose the employer to back-pay liability or support a claim that the employee was treated unlawfully.

Where feasible, less restrictive safeguards may include temporarily changing passwords, limiting system or cash access, reassigning custody functions, preserving logs, or placing the employee in a non-sensitive assignment—provided these measures are lawful and do not amount to demotion, discrimination, or constructive dismissal.

7. Evaluate all evidence fairly

The decision-maker should consider inculpatory and exculpatory evidence, including:

Whether the record is authentic and complete;
Who had physical or electronic access;
Whether accounts or passwords were shared;
Whether audit findings were independently verified;
Whether witnesses had personal knowledge or merely repeated hearsay;
Whether the employee benefited from the transaction;
Whether the act was intentional or could reasonably have been a mistake;
Whether instructions or deficient controls contributed to the event;
Whether similarly situated employees were treated consistently; and
Whether the proposed penalty is proportionate.

The employer bears the burden of proving a valid dismissal by substantial evidence. Mere accusations, unsupported audit conclusions, or self-serving statements do not meet that burden. See Manggagawa ng Komunikasyon sa Pilipinas v. PLDT and Southern Maligaya Taxi, Inc. v. Magsalin.

Internal findings do not require proof beyond reasonable doubt. But the lower evidentiary standard is not permission to guess, presume guilt from silence, or disregard contrary evidence.

8. Issue a reasoned written decision

If the employer concludes that discipline is warranted, the second written notice should state:

The charges considered;
The material evidence and defense evaluated;
The factual findings;
The applicable rule and legal ground;
The penalty imposed and its effectivity; and
Any available internal appeal or review process.

For dismissal, the notice should show that all relevant circumstances were considered and that grounds were established to terminate employment. It should not simply say “management has lost confidence.”

The decision must be based on the charges in the first notice. If the investigation uncovers a materially different offense, the safer course is to issue a new or supplemental notice and give the employee another meaningful opportunity to respond before relying on that offense.

When dismissal may still be illegal

A fraud-related dismissal may be illegal when:

The employer cannot prove the employee’s involvement by substantial evidence;
The alleged false entry was an error, negligent act, or system problem rather than intentional fraud;
Loss of trust is invoked against an employee who did not occupy a genuine position of trust;
The employer relies only on suspicion, an unsigned accusation, or an unverified audit summary;
The charge is vague or materially different from the ground stated in the final decision;
The employee was given an unreasonably short response period;
A requested or necessary conference was denied;
The decision was made before the employee’s explanation was considered;
The penalty is grossly disproportionate or discriminatorily applied; or
The employer forced a resignation, imposed an unjustified demotion, or made continued work unbearable instead of following the dismissal process.

If there was no valid just cause, the usual illegal-dismissal remedies may include reinstatement without loss of seniority rights and full back wages, subject to the facts, pleadings, and final ruling.

If a valid just cause existed but the employer failed to observe procedural due process, dismissal may remain valid, but the employer can be ordered to pay nominal damages. Under Agabon v. NLRC, the established amount for a just-cause dismissal made without proper statutory due process is generally ₱30,000. Other liabilities may arise from separate violations.

Should the employer file a criminal case?

An internal labor investigation and a criminal case are separate proceedings.

Falsified records may potentially involve offenses under the Revised Penal Code or a special law, depending on the type of document, the act performed, the person involved, and the circumstances. Not every inaccurate workplace record is criminal falsification.

The employer should not state that the employee is criminally guilty unless a court has convicted the employee. Before referring a matter to law enforcement, preserve originals and obtain legal advice concerning:

The correct possible offense and its elements;
The authenticity and custody of documents or electronic evidence;
The proper complainant and venue;
Affidavits from persons with personal knowledge;
Applicable prescriptive periods; and
Privacy, confidentiality, and disclosure restrictions.

A criminal acquittal or the absence of a criminal complaint does not automatically decide the labor case because the proceedings apply different rules and standards of proof. Conversely, filing a criminal complaint does not by itself establish a valid dismissal.

Employers must never use threats of baseless prosecution to force a resignation, waiver, or repayment.

Practical steps for an employee who receives a notice

Act promptly, even if the accusation appears weak.

Record the date and method by which the notice was received.
Read every alleged transaction, date, document, policy provision, and proposed ground.
Ask in writing for clarification or relevant records if the charge is too vague to answer.
Preserve lawful copies of schedules, emails, messages, approvals, job instructions, access records, policies, and prior evaluations. Do not take confidential material unrelated to the defense.
Prepare a dated, factual response addressing each allegation separately.
Identify shared accounts, system defects, supervisor instructions, missing controls, witnesses, or documents that explain the event.
Attach copies, retain proof of submission, and keep an exact copy of everything sent.
Request a conference in writing when credibility, authenticity, access, intent, or other material facts are disputed.
Consult the union, if applicable, and follow any grievance machinery in the collective bargaining agreement.
Do not sign a confession, resignation, settlement, quitclaim, or repayment agreement without understanding its contents and consequences.

An employee who needs more time should request a reasonable extension before the deadline, explain why it is needed, and propose a definite submission date. The employer should assess the request fairly, particularly where records are extensive or inaccessible.

Evidence both sides should preserve

A reliable case file commonly includes:

The complaint or incident report;
The original questioned records;
Audit work papers and reconciliation methods;
System-generated logs and native electronic files;
Documentation of collection and custody;
Job descriptions and access-authority matrices;
Relevant handbook provisions and proof they were communicated;
Notices, proof of receipt, explanations, attachments, and minutes;
Witness statements identifying the basis of personal knowledge;
Preventive-suspension notices and supporting risk assessment;
The written evaluation or decision; and
Payroll, status, and final-pay records.

Avoid deleting messages, overwriting files, coaching witnesses, backdating documents, creating reconstructed records without labeling them, or circulating allegations unnecessarily. Once a dispute is reasonably expected, deliberate destruction or alteration of relevant evidence can seriously damage credibility and may create separate liability.

Common mistakes

Mistakes employers make

Treating an audit exception as conclusive proof of fraud;
Using a template notice with no transaction-level facts;
Giving only 24 or 48 hours to explain;
Charging “dishonesty” but dismissing for a different uncharged offense;
Automatically suspending the employee without a serious and imminent threat;
Extending unpaid preventive suspension beyond 30 days;
Relying on shared-user logs without proving who used the account;
Ignoring the employee’s documents or witnesses;
Announcing guilt before completing the investigation;
Demanding a resignation instead of issuing a decision; and
Assuming that filing a police report cures a weak labor case.

Mistakes employees make

Ignoring the notice or responding only verbally;
Giving a blanket denial without addressing individual records;
Altering, deleting, or taking company data;
Missing the deadline without requesting an extension;
Failing to request a conference despite major factual disputes;
Signing documents that inaccurately state an admission or voluntary resignation; and
Waiting too long to seek labor assistance after dismissal.

When legal help is urgent

Prompt advice from a Philippine labor lawyer, union representative, or DOLE/NLRC officer is especially important when:

Dismissal or forced resignation is imminent;
Preventive suspension is approaching or has exceeded 30 days;
The employee has been denied access to the substance of the charge;
The case involves a large financial loss, regulated records, sensitive personal data, or possible criminal exposure;
Evidence may be deleted, altered, or removed;
A confession, quitclaim, repayment agreement, or resignation is being demanded;
The employee is an officer, manager, cashier, auditor, custodian, or other fiduciary employee;
Retaliation, discrimination, union activity, or whistleblowing may be involved; or
A filing deadline may expire.

Employees may seek assistance through DOLE’s Single Entry Approach or the appropriate NLRC office. Under the 2025 NLRC Rules of Procedure, money claims arising from employment generally prescribe in three years, while illegal-dismissal claims generally prescribe in four years. A request for assistance under the Single Entry Approach tolls these periods under the applicable rules. Do not wait until the last day: the correct remedy, forum, venue, and computation can depend on the claims and documents.

Frequently asked questions

Can an employer investigate before issuing a notice to explain?

Yes. A preliminary fact-finding review may be necessary to determine whether there is a credible charge. Once discipline or dismissal is being considered, the employee must receive specific notice and a meaningful opportunity to answer before the decision is made.

Must the employer prove actual financial loss?

Not always. Intentional falsification or breach of trust may be serious even if the loss was prevented or not precisely quantified. However, the employer must still prove the employee’s wrongful act, its work connection, and the applicable dismissal ground.

Is an admission enough?

A clear, voluntary, and reliable admission can be significant, but its wording and context matter. The employer should preserve the complete statement and supporting circumstances rather than isolate a phrase. A disputed, coerced, ambiguous, or inaccurately recorded “admission” should not be treated as conclusive.

Can the employee bring a lawyer to the administrative conference?

An employee may consult counsel and can request that counsel or a union representative attend. Whether participation is required or governed by company or collective-bargaining rules depends on the circumstances. A written request is advisable, particularly where criminal exposure or substantial evidentiary disputes exist.

Is a face-to-face hearing always required?

No. Due process ordinarily requires a meaningful opportunity to be heard, which may be written. A conference becomes mandatory when requested by the employee in writing, when substantial evidentiary disputes exist, when company rules or practice require one, or when similar circumstances make it necessary.

Can the employer rely on CCTV, email, or system logs?

Potentially, yes, if the material was lawfully obtained, relevant, authentic, complete enough to be reliable, and handled consistently with privacy and security duties. A login or device identifier alone may be insufficient where credentials or devices were shared.

Can an employee be preventively suspended without pay?

Yes, but only when continued employment poses a serious and imminent threat to life or property, and ordinarily for no more than 30 days. Preventive suspension cannot be used as an automatic penalty or as a shortcut to dismissal.

Does resignation end the investigation?

Not necessarily. The effect depends on whether the resignation was genuine and voluntary, when it became effective, applicable contracts and policies, and whether civil or criminal issues remain. A resignation obtained through coercion may be challenged as constructive dismissal.

Can an employer deduct the alleged loss from wages or final pay?

Not automatically. Wage deductions are regulated and require a lawful basis and compliance with applicable consent and due-process rules. An allegation or internal computation alone does not authorize an unrestricted deduction. Obtain case-specific advice before making or accepting deductions.

What if the employee refuses to receive the notice?

Document the refusal and use a reliable alternative method of service consistent with company rules and the circumstances. The employer should preserve proof of the date, address or channel, sender, contents, delivery attempts, and any acknowledgment or refusal.

Does proper procedure guarantee that dismissal is valid?

No. Procedure cannot substitute for evidence. Even perfect notices and conferences will not cure the absence of a valid, substantially proven just cause. Conversely, a valid cause does not excuse failure to observe the required procedure.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Employment status, company rules, collective bargaining agreements, evidence, dates, and the exact documents can change the analysis. Official sources were checked as of August 30, 2026.