Quick answer

An employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. For a valid termination under Philippine labor law, the employer must establish a lawful just cause through substantial evidence and observe procedural due process.

For fraud or willful breach of trust, the employer should generally:

Preserve and verify the relevant records without prejudging the employee.
Give the employee a detailed written notice to explain, identifying the acts, dates, records, applicable rules, and possible grounds for termination.
Allow at least five calendar days from receipt for a written explanation.
Provide a meaningful opportunity to answer the charge and submit evidence, with a representative if desired.
Hold a formal hearing when legally required.
Evaluate the entire record fairly.
Issue a separate written decision stating the established grounds and circumstances if dismissal is justified.

The employer bears the burden of proving a valid cause. An internal investigation does not require proof beyond reasonable doubt, but allegations, assumptions, anonymous accusations, or unexplained discrepancies are not substantial evidence by themselves.

What counts as employee fraud or falsification?

Article 297(c) of the Labor Code allows termination for “[f]raud or willful breach” of the trust reposed in an employee by the employer or its authorized representative. Depending on the facts, falsification may also amount to serious misconduct or another analogous just cause under Article 297.

Examples that may warrant investigation include deliberately:

Altering time records, sales reports, receipts, invoices, payroll data, inventory records, reimbursement claims, or audit documents
Creating fictitious transactions, customers, suppliers, expenses, deliveries, or employees
Forging an approval, signature, acknowledgment, or supporting document
Concealing a shortage, unauthorized withdrawal, conflict of interest, or diversion of company property
Entering false information to obtain money, benefits, commissions, employment, or another advantage
Deleting or changing electronic records to hide an unauthorized transaction

The label placed on the act is not controlling. The employer must prove what the employee actually did, whether it was intentional, how it related to the employee’s work, and why it falls under the cited legal or company ground.

An error, incomplete entry, disputed accounting treatment, system malfunction, negligence, or poor judgment is not automatically fraud. The Supreme Court has emphasized that fraud or dishonesty involves a disposition to deceive, defraud, or betray the employer. A willful breach is intentional, knowing, and purposeful—not merely careless, inadvertent, or thoughtless. See LBC Express–Vis, Inc. v. Palco and Lopez v. Alturas Group of Companies.

The employer must prove both cause and fair procedure

A lawful dismissal has two separate requirements:

Substantive due process: A just cause recognized by law must actually exist.
Procedural due process: The employee must receive proper notices and a meaningful opportunity to answer before the employer decides to dismiss.

Following the notice procedure cannot cure a charge unsupported by evidence. Conversely, strong evidence does not excuse an employer from giving the required notices and opportunity to be heard.

In an illegal-dismissal case, the employer carries the burden of proving the validity of the dismissal through substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion. Mere allegations are not evidence. The governing provisions appear in Article 297 of the Labor Code and DOLE Department Order No. 147-15.

When loss of trust and confidence applies

Not every employee may be dismissed simply because management says it has “lost confidence.”

The Supreme Court recognizes two principal classes of positions of trust:

Managerial employees whose duties involve management or the exercise or effective recommendation of managerial powers
Fiduciary rank-and-file employees—such as cashiers, auditors, property custodians, and employees who regularly handle significant company money or property

To rely on fraud or willful breach of trust, the employer must establish both that the employee occupied a position of trust and that an actual act justified the loss of trust. The loss must be genuine, work-related, and founded on clearly established facts; it cannot be a pretext for an arbitrary or unlawful dismissal.

For fiduciary rank-and-file employees, proof of the employee’s actual involvement is particularly important. Uncorroborated accusations are insufficient. The Supreme Court discusses these requirements in Ramos v. Tieza and Wesleyan University-Philippines v. Reyes.

Even when “loss of trust” does not fit the employee’s position, deliberately falsifying a material company record may still be examined under serious misconduct or another applicable just cause. The employer must identify and prove the correct ground rather than rely on a generic accusation of dishonesty.

A legally sound investigation process

1. Secure the evidence without deciding guilt in advance

The company should promptly preserve relevant material, such as:

Original paper records and authenticated copies
Audit trails, system logs, access records, and document-version histories
Emails, authorized workplace messages, approvals, and attachments
CCTV footage, subject to applicable retention and privacy rules
Accounting records, receipts, bank or payment records lawfully available to the employer
Written statements from witnesses with personal knowledge
The employee’s job description, authority limits, and access rights
The applicable contract, handbook, code of conduct, collective bargaining agreement, and prior written directives

Record who obtained each item, where it came from, and whether it was altered, exported, or copied. Preserve metadata and read-only originals where practicable. Investigators should distinguish personal knowledge from rumor and should test explanations such as shared credentials, delegated access, encoding errors, system defects, or unauthorized use by another person.

Evidence must be obtained lawfully. An investigation is not a blanket license to access an employee’s private accounts, seize a personal device, disclose accusations unnecessarily, or circulate sensitive personal information. Access and disclosure should be limited to legitimate investigation needs and handled consistently with company policy and the Data Privacy Act.

2. Identify the precise charge

Before issuing a notice to explain, determine:

The particular act or omission under investigation
The record or transaction allegedly falsified
The relevant dates, amounts, persons, and system entries
The employee’s alleged participation
The specific company rule and possible Labor Code ground
Whether the available evidence indicates intent, negligence, mistake, or an unresolved discrepancy

Avoid vague charges such as “fraud,” “dishonesty,” “loss of confidence,” or “falsification of company records” without supporting particulars.

3. Serve a detailed first written notice

Under DOLE Department Order No. 147-15, the first notice should contain:

The specific cause or ground under Article 297 and the applicable company policy, if any
A detailed narration of the facts and circumstances supporting the charge
A directive allowing the employee to submit a written explanation within a reasonable period

A general description does not suffice. The notice should identify the material records and conduct closely enough for the employee to prepare a real defense. If dismissal is a possible consequence, the notice should make that clear.

“Reasonable period” means at least five calendar days from receipt. This period allows the employee to study the accusation, consult a lawyer or union officer, gather evidence, and decide on the defenses to raise.

The employer should retain proof of personal service. If personal service cannot reasonably be made, the rules permit service at the employee’s last known address. Email or an internal platform may supplement service, but the employer should not rely exclusively on an uncertain electronic delivery method when receipt may later be disputed.

4. Give a meaningful opportunity to be heard

The employee must have a fair opportunity to:

Admit, deny, or explain each material allegation
Inspect or meaningfully respond to the evidence relied upon, subject to legitimate confidentiality and security safeguards
Submit documents and identify witnesses
Explain system access, approval practices, shared custody, or other relevant circumstances
Receive assistance from a representative, lawyer, or union officer if desired

“Ample opportunity to be heard” may be provided through a written explanation, conference, hearing, or another fair and reasonable method. A formal trial-type hearing is not automatically required.

A formal hearing or conference becomes mandatory when:

The employee requests it in writing;
Substantial factual or evidentiary disputes exist;
A company rule, established practice, employment agreement, or collective bargaining agreement requires it; or
Comparable circumstances make a hearing necessary for a fair resolution.

An internal administrative investigation is not a criminal trial. The employee does not necessarily have a constitutional right to confront and cross-examine witnesses in the same manner as an accused in court. The essential requirement is a genuine opportunity to understand and answer the case. The rule and its exceptions are explained in Perez v. Philippine Telegraph and Telephone Company.

5. Investigate new information before relying on it

If the employee’s response raises a material defense, verify it. If the investigation uncovers a substantially different charge, new transaction, or new ground for dismissal, give the employee adequate notice and an opportunity to answer that matter before using it as a basis for termination.

An employer should not charge an employee with one offense and dismiss that employee for an unnotified offense. In Foodbev International Consulting Corporation v. Ferrer, the Supreme Court found due-process defects where the charges, findings, and stated grounds for termination were inconsistent.

6. Decide from the complete record

The decision-maker should consider both incriminating and exculpatory evidence, including:

The reliability and source of each record
Whether the employee had exclusive or shared access
Whether the disputed entry produced or concealed a benefit
Evidence of intent or a reasonable alternative explanation
The employee’s duties and degree of trust
The materiality and consequences of the act
Applicable company rules and disciplinary provisions
Comparable prior cases under the employer’s policies
Length of service and other circumstances relevant to proportionality

An admission should be read in context. Silence, failure to explain, or failure to attend may be considered only after proper notice and a genuine opportunity to participate; it does not relieve the employer of proving a valid cause.

7. Serve a separate written decision

If the employer concludes that dismissal is justified, the second written notice should state that:

All relevant circumstances and the employee’s defenses were considered; and
The established facts constitute the specified ground or grounds for termination.

The notice should connect the findings to the charge and evidence. It should not merely announce that management has “lost trust” or that the explanation was “unsatisfactory.”

If the evidence does not establish the charge, the employee should be cleared or subjected only to a lawful and proportionate measure supported by the facts and applicable rules.

Can the employee be preventively suspended?

Yes, but only under narrow conditions. Preventive suspension is a protective measure pending investigation, not a punishment or a shortcut to dismissal.

It may be imposed when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. In a records-falsification case, this may include a demonstrated risk that the employee could alter or destroy vital records because of continuing access. The employer should document the specific risk instead of treating preventive suspension as automatic whenever fraud is alleged.

Preventive suspension generally may not exceed 30 days. After that, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the wages and benefits due during the extension. If the original suspension lacked sufficient basis, the employee may be entitled to wages for that period.

The Supreme Court explains these limits in Lao v. Special Plans, Inc. and Every Nation Language Institute v. Dela Cruz.

Less restrictive safeguards may sometimes address the risk, such as temporarily disabling particular system privileges, reassigning custody of records, requiring dual approval, or transferring the employee to non-sensitive duties. Any measure must remain lawful and must not amount to punishment, humiliation, or constructive dismissal.

Does the employer need a criminal case or conviction?

No. An employer does not have to wait for a criminal conviction before resolving an employment case. Labor and criminal proceedings have different purposes and standards:

A labor case generally requires substantial evidence.
A criminal conviction requires proof beyond reasonable doubt.

Likewise, the filing of a criminal complaint or a prosecutor’s finding of probable cause does not automatically prove a valid dismissal. An acquittal does not automatically make the dismissal illegal. The employer and labor tribunals must independently assess the employment evidence. See Minex Import Corporation v. Morillo and Philippine Long Distance Telephone Company v. Teves.

A criminal complaint should not be threatened merely to force a resignation, waiver, or repayment. When criminal exposure is genuinely possible, both sides should obtain independent legal advice promptly.

Records each side should preserve

For the employer

Keep:

The original complaint, audit finding, or incident report
Evidence-preservation and access logs
Copies of the records allegedly altered
Proof linking the employee to the act
Applicable policies and proof that they were communicated
The first notice and proof of service
The employee’s explanation and attachments
Hearing invitations, minutes, attendance records, and submissions
Investigation findings and supporting documents
The written decision and proof of service
The basis, dates, and payroll treatment of any preventive suspension

For the employee

Keep lawfully obtained copies of:

The notice to explain and attachments
Proof of the date and manner of receipt
The employment contract, job description, handbook, and applicable policies
Emails, approvals, work instructions, schedules, and system messages supporting the defense
Records showing shared access, delegated authority, technical problems, or ordinary work practices
The written explanation and proof that it was submitted
Requests for documents, more time, representation, or a formal hearing
Meeting notices, personal notes, minutes, and the final decision
Payslips and records of suspension, loss of access, reassignment, or dismissal

Do not secretly take trade secrets, customer databases, personal data, or company files unrelated to the defense. Do not delete, alter, backdate, fabricate, or coach evidence.

Common mistakes that undermine an investigation

Dismissing immediately after discovering a discrepancy
Treating an audit exception as conclusive proof of fraud
Using vague notices without dates, transactions, records, or specific acts
Giving fewer than five calendar days to explain
Deciding the outcome before receiving the employee’s response
Refusing a written request for a hearing despite substantial factual disputes
Relying on a ground not included in the charge
Using hearsay or anonymous reports without verification
Assuming that system credentials prove who made an entry
Ignoring evidence of shared passwords, delegated access, or system error
Imposing preventive suspension without a serious and imminent threat
Extending unpaid preventive suspension beyond 30 days
Pressuring the employee to resign or sign a quitclaim
Publicly accusing the employee before findings are made
Filing a criminal complaint and assuming it automatically validates dismissal

Consequences of getting the process wrong

If no just cause is proven, the dismissal is illegal even if notices and meetings were provided. Under Article 294 of the Labor Code, an unjustly dismissed employee may generally be entitled to reinstatement without loss of seniority and privileges, plus full backwages, allowances, and benefits or their monetary equivalent. Separation pay may be awarded instead when reinstatement is no longer feasible, depending on the case.

If a valid just cause is proven but the employer failed to observe statutory due process, the dismissal may remain valid, but the employer may be ordered to pay nominal damages. Under Agabon v. NLRC, the Supreme Court fixed nominal damages at ₱30,000 for a just-cause dismissal implemented without proper procedural due process. Other relief may depend on the particular violations and evidence.

Practical steps for an employee who receives a notice

Record the exact date and time of receipt.
Read each allegation separately and identify missing details.
Request the supporting records needed to respond, without demanding confidential material unrelated to the charge.
Ask promptly for reasonable additional time if the evidence is extensive or was supplied late. Do not assume the extension has been granted.
Prepare a factual, chronological response addressing every allegation.
Attach genuine supporting documents and identify relevant witnesses.
State clearly if access was shared, an instruction was given orally, a system failed, or another person made the entry.
Request a formal hearing in writing if material facts are disputed or credibility must be resolved.
Ask for assistance from a union representative or lawyer where appropriate.
Continue complying with lawful instructions unless officially suspended or advised otherwise.

Avoid emotional accusations, guesses about motives, blanket denials contradicted by records, or alterations to evidence. Do not sign a confession, resignation, settlement, or quitclaim that you do not understand.

When legal help is urgent

Seek advice quickly if:

Dismissal appears predetermined or has already taken effect
The notice gives less than five calendar days to explain
The accusation involves large losses, forged signatures, cybercrime, theft, or possible imprisonment
Police, prosecutors, the NBI, or another agency has contacted either side
The employer asks the employee to surrender a personal device or account credentials
The employee is being compelled to resign or sign a waiver
Preventive suspension has no stated basis or is nearing 30 days
Evidence may be deleted under a short retention policy
The case involves union rights, retaliation, discrimination, whistleblowing, or a collective bargaining agreement
A labor complaint, subpoena, summons, or NLRC decision has been received

An aggrieved worker or employer may request conciliation assistance through the official DOLE Assistance for Request Management System. Requests for Assistance under the Single Entry Approach may also be filed at participating DOLE, National Conciliation and Mediation Board, or National Labor Relations Commission offices. Do not delay merely because settlement discussions are ongoing; different labor claims may have different prescriptive periods and procedural deadlines.

Frequently asked questions

Is an admission required before an employee may be dismissed?

No. A dismissal may be supported by substantial evidence even without an admission. The evidence must still reasonably establish the employee’s participation and the applicable just cause.

Is an audit report enough?

Not automatically. An audit report may be important evidence, but the employer should establish the underlying records, methodology, employee participation, and material findings. The employee must be allowed to answer the report’s factual basis.

Must the employer disclose every document in its possession?

The rules require a meaningful opportunity to answer, not necessarily unlimited discovery equivalent to a court case. The employer should disclose or adequately describe the material evidence relied upon so the employee can respond, while protecting unrelated confidential and personal information.

Can the employer impose dismissal for a first offense?

Potentially, yes. Fraud or deliberate falsification may be sufficiently grave to justify dismissal even on a first proven offense, depending on the employee’s position, the act, applicable rules, and surrounding circumstances. Dismissal is not automatic merely because a policy labels an offense as fraud.

What if the employee refuses to receive the notice?

The employer should document the refusal and use a permitted method of service, including delivery to the employee’s last known address. Refusal does not erase the employer’s obligation to prove both proper notice and a valid cause.

What if the employee does not submit an explanation?

After valid notice and a reasonable opportunity to respond, the employer may decide from the available evidence. Non-response is not, by itself, proof that the fraud occurred.

Can an employee bring a lawyer to the company hearing?

The employee may obtain assistance from a representative, including counsel if desired. The notice period is intended in part to allow consultation with a lawyer or union officer. Company investigations, however, remain administrative rather than courtroom proceedings.

Can the employer report the matter to the police while the investigation is pending?

A genuine suspected crime may be reported, but the criminal and employment processes remain separate. A police report or criminal complaint does not replace the twin-notice procedure or the employer’s obligation to prove just cause.

Does paying back the amount erase the offense?

Not necessarily. Restitution may be relevant to the facts or penalty, but it does not automatically eliminate a proven intentional fraud or breach of trust. Conversely, repayment made under pressure is not automatically an admission.

Does this process apply to probationary employees?

A probationary employee dismissed for an alleged just cause such as fraud remains entitled to the just-cause notice and opportunity requirements. A different rule may apply when termination is based solely on failure to meet reasonable regularization standards made known at the time of engagement. Employers should identify the true ground and follow the procedure applicable to it.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The proper result depends on the employee’s duties, the exact notices, company or CBA rules, and the admissible evidence. Official sources and procedures were checked as of August 26, 2026.