Quick answer

An employer may investigate suspected employee fraud or falsified records and may impose discipline, including dismissal, only if both substantive cause and procedural due process are present.

For dismissal in the private sector, the employer generally must:

Identify and preserve reliable evidence.
Give the employee a detailed written notice of the charge.
Allow at least five calendar days from receipt to submit an explanation.
Provide a meaningful opportunity to answer the evidence and present a defense.
Conduct a hearing or conference when required by the circumstances.
Decide impartially using substantial evidence.
Serve a written decision explaining the established ground and the penalty.

A suspicion, audit discrepancy, anonymous accusation, or label such as “fraud” is not enough by itself. The employer must establish the employee’s specific acts and connect them to a lawful ground for discipline. The employee, meanwhile, should respond on time, request the relevant records, preserve evidence, and place every material defense in writing.

What law applies?

For private-sector employment, Article 297 of the Labor Code of the Philippines recognizes several just causes for dismissal that may apply to fraud or falsification, including:

Serious misconduct;
Fraud or willful breach of the trust placed in the employee;
Willful disobedience of a lawful, reasonable, and work-related order;
Gross and habitual neglect of duties, when the facts support it; and
Causes analogous to those expressly listed.

The employer must also comply with Article 292(b) of the Labor Code and the procedural standards in DOLE Department Order No. 147-15.

This discussion concerns employees of private employers. Government personnel are subject to civil-service laws and administrative disciplinary rules, which have different procedures.

Fraud, falsification, and loss of trust are not interchangeable

Fraud or willful breach of trust

Dismissal for loss of trust and confidence generally requires proof that:

The employee occupied a position of trust and confidence; and
The employee committed an act that genuinely justified the loss of trust.

Positions of trust commonly include:

Managerial employees who exercise substantial management authority; and
Fiduciary rank-and-file employees who routinely handle significant money, property, records, or similarly sensitive responsibilities, such as cashiers, auditors, and property custodians.

The breach must be work-related, intentional, and founded on clearly established facts. Loss of confidence cannot be simulated, used as a cover for an improper reason, asserted arbitrarily, or raised only as an afterthought. The Supreme Court explains these requirements in Menez v. Status Maritime Corporation and Gan v. Galderma Philippines, Inc..

An ordinary mistake, encoding error, misunderstood instruction, or careless act does not automatically amount to a willful breach. Intent, the employee’s duties, access to the records, surrounding circumstances, and any credible explanation all matter.

Serious misconduct

Falsifying a time record, reimbursement, sales entry, medical document, inventory record, payroll record, official report, or supporting document may constitute serious misconduct when the act:

Violates an established and definite rule;
Is grave rather than trivial;
Relates to the employee’s work and shows unfitness to remain employed; and
Was committed with wrongful intent.

A document discrepancy does not prove serious misconduct unless the evidence identifies who made or authorized it and supports the required wrongful intent.

Violation of company rules

A company may enforce a lawful disciplinary code, but it should identify the exact policy allegedly violated and show that the employee knew or reasonably should have known the rule. The penalty should be supported by the rule and proportionate to the proven offense, taking relevant circumstances into account.

An employer cannot cure weak evidence merely by using broad charges such as “dishonesty,” “fraud,” or “acts prejudicial to the company.” The Supreme Court has stressed that specific acts must be alleged and proved; a general accusation is not evidence. See Tay v. GJH Sercons, Inc..

The proper investigation process

1. Secure the evidence without prejudging the case

The employer should first preserve the original or authoritative version of relevant material, which may include:

Paper and electronic records;
Audit trails and system logs;
Timekeeping or access-control data;
Approval histories;
Emails and work messages;
CCTV footage obtained and retained lawfully;
Transaction records, vouchers, receipts, and reconciliations;
Policies, job descriptions, delegations of authority, and prior instructions; and
Statements from people with personal knowledge.

Copies should be traceable to their source. Investigators should document who collected each record, when it was collected, and whether it was altered, exported, or converted. Material that supports the employee’s explanation should not be ignored or suppressed.

Where several employees had access to the same account, password, form, or physical record, access alone may not establish authorship. Shared credentials, delegated work, system errors, backdated approvals, and ordinary corrections should be examined.

2. Define the charge precisely

Before issuing a notice, the employer should determine:

What specific entry, document, transaction, or representation is challenged;
When and where the alleged act occurred;
What the employee allegedly did or failed to do;
What evidence connects the employee to the act;
What policy or lawful ground may have been violated; and
Whether dismissal is genuinely under consideration.

The investigation should distinguish confirmed facts from assumptions and unresolved questions.

3. Serve a detailed first notice

The first written notice—often called a notice to explain or NTE—should state:

The specific facts and circumstances of the charge;
Relevant dates, transactions, records, and acts attributed to the employee;
The company rule and the applicable just cause being considered;
That dismissal may be imposed, if that is a possible outcome;
The period for submitting a written explanation; and
How and where the response and supporting evidence should be delivered.

DOLE Department Order No. 147-15 construes a reasonable response period as at least five calendar days from the employee’s receipt of the notice. The purpose is to give the employee enough time to study the accusation, consult a representative or lawyer if desired, gather evidence, and prepare a defense.

A vague order to “explain the irregularities” may be inadequate when it does not identify the transactions, conduct, or rule involved. New material charges should ordinarily be put to the employee before they are used as grounds for dismissal.

The employer should retain proof of actual service or receipt. Refusal to sign an acknowledgment does not necessarily prevent service, but the employer should document the manner, date, and witnesses to delivery.

4. Give a genuine opportunity to respond

The employee should be allowed to:

Deny, admit, or qualify each material allegation;
Explain the workflow and surrounding circumstances;
Identify other people with relevant knowledge or access;
Submit documents, messages, logs, affidavits, or other evidence;
Point out inaccuracies or missing context in the employer’s records;
Request clarification of vague charges; and
Seek reasonable access to the evidence needed for an intelligent response, subject to legitimate confidentiality and security controls.

The opportunity must be real, not ceremonial. A decision made before the response period expires, or an investigation conducted only to confirm a predetermined dismissal, is inconsistent with due process.

Failure to submit an explanation after proper notice and a genuine opportunity does not automatically prove guilt. It allows the employer to decide using the available evidence, but the evidence must still be substantial.

5. Hold a hearing or conference when necessary

A formal trial-type hearing is not required in every dismissal investigation. Written submissions may satisfy the right to be heard if they provide a meaningful opportunity to answer the charge and present evidence.

A hearing or conference becomes particularly important—and may be mandatory—when:

The employee requests one in writing;
There are substantial factual or evidentiary disputes;
Witness credibility or conflicting accounts must be evaluated;
Company policy, established practice, an employment contract, or a collective bargaining agreement requires it; or
Similar circumstances make a conference necessary for a fair investigation.

These principles are explained in Perez v. Philippine Telegraph and Telephone Company.

The employee may be assisted by a representative if desired. The investigator should keep accurate minutes, record the evidence received, and allow the employee to correct material inaccuracies in the record.

Can the employee be preventively suspended?

Yes, but preventive suspension is not automatic whenever fraud is alleged. It may be imposed only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers.

In a records-falsification investigation, this may be relevant where the employee retains access that could permit alteration or destruction of vital records, interference with systems, or further loss. The employer should document the concrete risk and consider less restrictive safeguards, such as temporarily changing access permissions or assigning non-sensitive duties.

Preventive suspension generally may not exceed 30 days. After that, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the wages and benefits due during the extension. An unjustified or excessively prolonged suspension can result in wage liability and, depending on the facts, constructive dismissal. The governing standards appear in Sections 8 and 9, Rule XXIII, Book V of the Omnibus Rules and are discussed in Every Nation Language Institute v. Dela Cruz.

Preventive suspension is protective, not a declaration of guilt or a disciplinary penalty.

What level of proof is required?

The employer bears the burden of proving a lawful dismissal by substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

This is lower than proof beyond reasonable doubt, but it is more than suspicion, rumor, an unsupported accusation, or a conclusory audit finding. The evidence should reasonably establish:

The integrity and meaning of the questioned record;
The employee’s involvement;
The required intent or willfulness;
The connection to the employee’s duties or position of trust; and
The lawful ground and appropriateness of the penalty.

The investigation should address credible contrary evidence. An employer cannot rely solely on the employee’s job title, mere access to a system, collective responsibility, or the fact that a loss occurred.

An acquittal, dismissal, or absence of a criminal case does not by itself resolve the employment case because criminal and labor proceedings apply different issues and standards of proof. Conversely, filing a criminal complaint does not relieve the employer of its duty to prove a lawful dismissal and observe labor due process.

The written decision

After considering the employee’s explanation and all material evidence, the employer should issue a second written notice stating:

The findings on each material charge;
The evidence relied upon;
Why the employee’s material defenses were accepted or rejected;
The company rule and legal ground established;
The penalty imposed; and
The effective date, if employment is terminated.

The decision should rest on charges disclosed in the first notice or in a properly served supplemental notice. It should not introduce a new ground that the employee had no opportunity to answer.

A finding of wrongdoing does not automatically require dismissal. The employer should evaluate the gravity and work-related effect of the act, the position held, the employee’s participation and intent, applicable policy, consistency of enforcement, prior record when legitimately relevant, and mitigating or aggravating circumstances.

Evidence employees should preserve

An employee who receives an NTE, suspension order, or dismissal notice should promptly keep personal, lawful copies of:

The NTE and proof of the date received;
The written explanation and proof of submission;
The suspension and termination notices;
Employment contract, job description, policies, and relevant memoranda;
Payslips, schedules, and time records;
Relevant emails, messages, approvals, and instructions;
Records showing who had system or physical access;
Names and contact details of potential witnesses;
Meeting invitations, minutes, recordings made lawfully, and written requests;
Performance records and earlier disciplinary documents; and
A dated chronology of events.

Do not alter, delete, conceal, fabricate, or remove company records without authority. Preserve evidence through lawful means and request copies or inspection in writing when necessary.

Common mistakes

Mistakes by employers

Issuing a vague NTE without dates, transactions, acts, or rules;
Allowing fewer than five calendar days from receipt to explain;
Treating silence as conclusive proof;
Relying only on suspicion, hearsay, job title, or system access;
Ignoring evidence inconsistent with the accusation;
Adding new grounds only in the termination notice;
Treating preventive suspension as punishment;
Exceeding 30 days of unpaid preventive suspension;
Refusing a justified written request for a hearing;
Applying a penalty inconsistently or without considering the actual gravity of the offense; and
Deciding the case before receiving or considering the defense.

Mistakes by employees

Ignoring the NTE or responding only verbally;
Missing the deadline without requesting an extension;
Giving a general denial instead of answering each allegation;
Signing an inaccurate confession, resignation, or settlement without understanding it;
Deleting messages or changing disputed records;
Taking confidential company data unrelated to the defense;
Failing to request missing particulars or relevant evidence in writing; and
Assuming that resignation or absence will end the investigation without other consequences.

When legal help is urgent

Prompt advice from a Philippine labor lawyer, union representative, or qualified worker-assistance office is especially important when:

Dismissal is expressly threatened;
The response deadline is approaching;
The NTE involves large losses, forged documents, payroll, taxes, regulated records, or possible criminal liability;
The employer asks for a confession, resignation, waiver, or repayment agreement;
The employee is preventively suspended beyond 30 days without pay;
Access to potentially exculpatory evidence is being denied;
The charge appears retaliatory, discriminatory, or connected to protected union activity;
A collective bargaining agreement has a grievance procedure or stricter safeguards; or
The employee has already been dismissed.

An illegally dismissed employee may pursue relief before the National Labor Relations Commission. The NLRC states that an illegal-dismissal claim generally prescribes in four years from accrual, while many employment-related money claims prescribe in three years. Do not wait for the end of those periods: evidence and practical remedies become harder to secure with delay. Current procedural information is available through the NLRC official website and its frequently asked questions.

Frequently asked questions

Is an NTE already a finding of guilt?

No. It should notify the employee of the accusation and provide a fair chance to answer. Language showing that management has already reached a final conclusion may support a claim that the process was predetermined.

Must the employer give copies of every document?

The law does not necessarily require unrestricted disclosure of every company record. However, the notice must contain enough specific facts for an intelligent defense, and a fair process should permit meaningful access to material evidence subject to legitimate confidentiality, privacy, and security restrictions.

Is five calendar days always enough?

Five calendar days is the regulatory minimum for a reasonable opportunity to explain. More time may be necessary when the records are extensive, the allegations are complex, the employee is ill or unavailable for a legitimate reason, or essential documents have not been provided. Any extension request should be specific and made in writing before the deadline.

Can the employee insist on a lawyer?

The employee may seek assistance from a representative or lawyer. An internal investigation is not automatically a courtroom proceeding, but representation may be especially important where the facts are disputed or criminal exposure is possible. A collective bargaining agreement or company policy may provide additional rights.

Can falsifying one record justify dismissal?

Possibly, but not automatically. A single deliberate falsification may be sufficiently serious depending on the record, the employee’s duties, the intent, the harm or risk created, and the applicable policy. A harmless clerical mistake or unproven discrepancy is different from an intentional fabrication.

Does the employer need a criminal conviction before dismissing an employee?

No. An employment decision may be made under the substantial-evidence standard without waiting for a criminal conviction. The employer must nevertheless prove a lawful employment ground and follow the required dismissal procedure.

What if there is a valid cause but the notices were defective?

A valid substantive cause does not excuse a denial of procedural due process. Under Supreme Court doctrine, the dismissal may remain effective if a just cause is actually proved, but the employer may be ordered to pay nominal damages for violating the employee’s statutory rights. If the employer cannot prove a just cause, the dismissal may be illegal, with materially different remedies.

What if the company has a stricter procedure?

The employer should follow applicable contractual, collective-bargaining, handbook, and established procedural commitments in addition to statutory minimums. A required grievance or appeal process should be used promptly, without assuming that it automatically suspends all legal filing periods.

This article provides general legal information, not legal advice, and cannot determine the outcome of a particular investigation without reviewing the evidence, employment documents, workplace rules, and applicable agreements. Philippine legal sources and procedures were checked as of August 27, 2026.