Quick answer

A Philippine private-sector employer may investigate suspected employee fraud or falsified company records, but suspicion alone does not justify dismissal. A lawful termination generally requires both:

Substantive due process: substantial evidence of a just cause under Article 297 of the Labor Code, such as fraud, willful breach of trust, or serious misconduct; and
Procedural due process: a specific written notice of the charge, a meaningful opportunity to answer and present evidence, fair consideration of the employee’s defense, and a written notice of the final decision.

The investigation should remain impartial and undecided until the employee’s explanation and the relevant records have been evaluated. An employer need not wait for a criminal conviction, but an accusation, audit discrepancy, or unsupported conclusion is not enough.

These rules primarily concern private-sector employment. Government employees are governed by separate civil-service and administrative disciplinary rules.

What must be proved

Article 297 of the Labor Code recognizes fraud or willful breach of the trust reposed in an employee as a just cause for termination. Depending on the facts, deliberate falsification may also constitute serious misconduct or an analogous cause.

The label placed on the offense is not controlling. The employer must establish the acts actually committed and explain why those acts fall within the stated legal or company-rule violation.

Fraud or willful breach of trust

Dismissal based on loss of trust and confidence ordinarily requires proof that:

The employee occupied a position of trust and confidence or was entrusted with sensitive property, funds, records, systems, or responsibilities;
The employee committed an identifiable act justifying the loss of trust;
The act was connected with the employee’s duties; and
The breach was willful—done intentionally, knowingly, and purposely, without a justifiable excuse.

The loss of trust must be genuine and supported by clearly established facts. It cannot rest on whims, caprice, rumor, or a conclusion invented after the employer has already decided to dismiss the employee.

Not every clerical error, incorrect entry, procedural lapse, or unexplained variance is fraud. The investigation should distinguish deliberate deception from negligence, misunderstanding, an inadequate system, unauthorized use by another person, or an innocent mistake.

Serious misconduct

If the charge is serious misconduct, the employer generally must show that the conduct:

Was serious rather than trivial;
Related to the performance of the employee’s work and demonstrated unfitness to continue working; and
Was committed with wrongful intent.

A company may cite more than one ground when the facts genuinely support them, but every ground relied upon in the final decision should have been clearly disclosed to the employee while there was still an opportunity to answer it.

The required level of proof

In an illegal-dismissal case, the employer bears the burden of proving a valid cause by substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

This standard is lower than proof beyond reasonable doubt in a criminal case, but it still requires evidence. Mere allegations, speculation, or a declaration that management has “lost confidence” will not substitute for proof.

A fair investigation, step by step

1. Secure the records without declaring anyone guilty

Preserve the original evidence promptly and lawfully. Depending on the allegation, this may include:

Original paper forms and authenticated copies;
Audit trails, revision histories, access logs, and system timestamps;
Timekeeping, payroll, accounting, inventory, procurement, or expense records;
Emails, messages, approvals, and transaction histories;
CCTV footage retained under applicable policy;
Relevant company policies and proof that the employee received them;
Witness statements based on personal knowledge; and
Records showing who had authority or access at the relevant time.

Record where each item came from, who collected it, and whether it was altered, copied, exported, or transferred. Preserve potentially exculpatory material as well as evidence supporting the allegation.

Access should be limited to people who need the information for the investigation, legal compliance, or business protection. Evidence collection must respect applicable privacy, communications, cybersecurity, and contractual rules.

2. Identify the exact charge

Before issuing a notice to explain, determine:

The specific entry, document, transaction, or act in question;
The date, place, amount, system, or account involved;
What the employee allegedly did or failed to do;
Why the act appears intentional;
The employee’s relevant duty or authority;
The company rule allegedly violated; and
The Labor Code ground that may apply if dismissal is being considered.

An employer should not use a vague charge such as “dishonesty,” “fraud,” or “loss of trust” without the underlying facts.

3. Issue a detailed first written notice

When termination for just cause is under consideration, the first notice should:

Identify the particular acts or omissions charged;
Give a detailed narration of the material facts and circumstances;
State the applicable company rule and the possible Labor Code ground;
Inform the employee that dismissal or another disciplinary sanction may result;
Direct the employee to submit a written explanation; and
Provide a reasonable period to prepare a defense.

Under the Supreme Court’s formulation in King of Kings Transport, Inc. v. Mamac, reasonable opportunity should ordinarily mean at least five calendar days from receipt of the notice. This allows the employee to study the accusation, seek advice from a union representative or lawyer, gather records, and prepare a response.

The notice should be served in a verifiable manner. If ordinary service is not possible, the employer should follow the applicable rules, company policy, collective bargaining agreement, and requirements concerning service at the employee’s last known address.

4. Give a genuine opportunity to respond

The employee should be allowed to:

Explain or deny the charge;
Correct inaccurate assumptions;
Identify other people with relevant access or responsibility;
Submit documents, messages, logs, or witness statements;
Raise system, authorization, custody, or authentication issues;
Explain circumstances that may negate intent; and
Request a hearing or conference when one is necessary.

A written explanation may satisfy the opportunity-to-be-heard requirement in an appropriate case. A formal trial-type hearing is not automatically required. A conference or hearing should nevertheless be held when:

The employee requests one in writing;
Material factual or evidentiary disputes require clarification;
Company rules, established practice, or a collective bargaining agreement require it; or
Comparable circumstances make a hearing necessary for a meaningful defense.

Where a hearing is held, the employee should be allowed to explain the defense, present supporting evidence, and meaningfully answer the employer’s evidence. Representation should be permitted when required by law, company rules, or the applicable collective bargaining agreement, and when otherwise necessary to provide an ample opportunity to be heard.

5. Investigate the defense, not only the accusation

The investigator should verify both inculpatory and exculpatory explanations. Important questions may include:

Was the document actually made or altered by the employee?
Were login credentials shared, compromised, or used from another device?
Did other people have physical or system access?
Is the audit trail complete and reliable?
Did an authorized supervisor direct or approve the entry?
Was the procedure clear, consistently implemented, and communicated?
Does the evidence show intentional falsification, or only error or negligence?
Are witness accounts based on personal knowledge?
Is the proposed finding consistent with the employer’s treatment of comparable cases?

A confession or admission should be documented accurately and voluntarily. A statement should not be distorted by removing qualifications or context.

6. Make an impartial, evidence-based decision

The decision-maker should review the charge, the employee’s complete answer, supporting and contrary evidence, and any hearing record. The inquiry is not whether misconduct is merely possible, but whether substantial evidence establishes the charged act and the legal ground invoked.

The employer should also consider whether dismissal is proportionate under the facts, company rules, and applicable jurisprudence. Relevant circumstances may include the nature of the falsification, the employee’s duties, intent, actual or potential harm, concealment, prior related offenses, length and quality of service, and consistent treatment of comparable violations. These considerations do not automatically excuse proven fraud, but they may affect the proper sanction.

Prior offenses should not be used as a substitute for proof of the present charge. Previously committed infractions are most defensible as an additional consideration when properly documented and sufficiently related to the current offense.

7. Issue a reasoned second written notice

If the employer concludes that dismissal is justified, the second notice should:

Identify the findings supported by the evidence;
Address the material defense raised by the employee;
State the company rule and legal ground established;
Explain why the evidence warrants dismissal; and
State the effective date of termination and any lawful arrangements concerning final pay and company property.

The decision must follow—not precede—the employee’s opportunity to defend against the charge. A notice that merely announces a conclusion, or relies on charges never included in the first notice, creates a serious due-process problem.

If the charge is not established, the employer should close the case or impose only a lawful and proportionate sanction supported by the findings.

Preventive suspension during the investigation

Preventive suspension is not automatic whenever fraud is alleged. It is a protective measure, not a penalty.

An employer may place an employee under preventive suspension when continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. In a records-falsification case, relevant facts may include continued access to funds, original documents, audit logs, company systems, witnesses, or property that could be altered, destroyed, or misused.

Ordinarily, preventive suspension may not exceed 30 days. After that period, the employee must be reinstated to the former or a substantially equivalent position, or the suspension may be extended with payment of the wages and benefits due during the extension. The employee need not reimburse that extension pay if dismissal is later imposed.

If preventive suspension lacked a sufficient basis, the employee may be entitled to wages for the period of suspension. Employers should document the specific threat, consider less restrictive controls such as temporary reassignment or access restrictions, and avoid using suspension as advance punishment.

An internal case and a criminal case are separate

Falsified records may potentially raise criminal, civil, regulatory, or data-protection issues, but those proceedings are distinct from employment discipline.

An employer does not necessarily have to file a criminal case or wait for a conviction before making an employment decision. Likewise, the dismissal of a criminal complaint or an acquittal does not automatically decide whether there was a valid employment ground, because criminal and labor proceedings apply different standards of proof.

That does not permit an employer to treat the filing of a police or prosecutor’s complaint as automatic proof of fraud. The employer must still conduct a fair employment process and possess substantial evidence supporting the ground for dismissal.

Anyone considering a criminal complaint should obtain case-specific legal advice, particularly where original documents, electronic evidence, affidavits, access to counsel, or possible self-incrimination are involved.

What an employee should do after receiving a notice

An employee accused of fraud or falsification should act promptly:

Note the exact date and method of receiving the notice.
Read each alleged act, date, transaction, rule, and possible penalty carefully.
Ask in writing for clarification or reasonably necessary records if the charge is too vague to answer intelligently.
Preserve lawful copies of relevant documents, messages, schedules, approvals, and access information. Do not take confidential records unrelated to the defense.
Prepare a chronological, factual response addressing every allegation.
Identify other authorized users, witnesses, system problems, or instructions relevant to the disputed record.
Request a hearing in writing when material facts are disputed or documents and witnesses need clarification.
Consult the union, a labor lawyer, or an appropriate government office before signing an admission, resignation, quitclaim, or settlement that is not fully understood.
Keep copies of every notice, response, attachment, proof of delivery, suspension order, and decision.

Failure to respond may allow the employer to decide on the available evidence, but it does not erase the employer’s burden to establish a valid cause. If more time is genuinely needed, request an extension before the deadline and explain why.

Evidence both sides should preserve

Useful evidence commonly includes:

The questioned record in its original form;
Metadata, audit trails, version history, and access logs;
Written authority, approvals, delegation records, and workflow rules;
Proof of the employee’s job duties and level of access;
Policies in effect on the incident date and proof of dissemination;
Relevant emails, messages, tickets, and system notifications;
Comparable authentic records showing ordinary procedure;
CCTV or physical-access records, where lawfully collected;
Audit methods and the underlying source data;
Signed and dated witness statements based on firsthand knowledge;
Notices, written explanations, hearing minutes, and attachments; and
Proof of service and receipt.

Screenshots alone may omit context or be difficult to authenticate. Preserve the source record, not merely a cropped image. Neither party should delete, alter, fabricate, backdate, coach, or conceal evidence.

Common mistakes

Mistakes by employers

Deciding to dismiss before receiving the employee’s explanation;
Using a generic notice with no dates, transactions, or factual details;
Allowing only 24 or 48 hours to answer without a legally sufficient reason;
Treating an audit variance as conclusive proof of intentional fraud;
Relying exclusively on suspicion, hearsay, or a witness with no personal knowledge;
Adding new charges only in the termination letter;
Ignoring evidence favorable to the employee;
Using “loss of trust” against an employee without identifying the position of trust and the work-related betrayal;
Imposing preventive suspension without a serious and imminent threat;
Keeping an unpaid preventive suspension beyond 30 days;
Disregarding a collective bargaining agreement or established disciplinary procedure; and
Applying penalties inconsistently without a legitimate explanation.

Mistakes by employees

Ignoring the notice or submitting only a bare denial;
Missing the response deadline without requesting an extension;
Deleting messages or altering the questioned records;
Taking confidential company data unrelated to the defense;
Sharing the investigation publicly or intimidating witnesses;
Assuming that the absence of a criminal case automatically defeats the employment charge;
Signing a resignation, confession, or quitclaim under pressure without reading it; and
Failing to keep proof of what was submitted and when.

Consequences of a defective dismissal

If there is no valid just cause, dismissal may be declared illegal, with remedies determined under the Labor Code and the facts of the case.

If a just cause is established but the employer failed to observe the required dismissal procedure, the dismissal may remain valid, but the employer may be ordered to pay nominal damages. Supreme Court decisions applying Agabon v. NLRC have commonly fixed nominal damages at ₱30,000 for dismissal based on just cause without proper statutory due process. The result remains fact-dependent, and this amount should not be treated as a license to “dismiss now, pay later.”

When legal help is urgent

Seek prompt advice from a Philippine labor lawyer, union representative, DOLE office, or the NLRC when:

The response or hearing deadline is near;
The notice is vague but dismissal is threatened;
Preventive suspension is unsupported or approaching 30 days;
The employee is being pressured to resign, confess, or sign a quitclaim;
Records may be destroyed, overwritten, or altered;
Police, prosecutors, regulators, or data-protection authorities are involved;
The allegation concerns large losses, multiple employees, senior management, or regulated records;
Retaliation, discrimination, union activity, or whistleblowing may be involved; or
A termination notice has already been served.

An illegal-dismissal claim generally prescribes in four years from accrual, while many monetary claims arising from employment prescribe in three years. Waiting is risky because evidence and filing options may be lost earlier. Current NLRC rules should be checked for the applicable Single Entry Approach and filing procedure.

Frequently asked questions

Is five calendar days always required for the employee’s explanation?

For a contemplated just-cause dismissal, Supreme Court jurisprudence treats at least five calendar days from receipt as the ordinary reasonable opportunity to answer. A longer period may be appropriate for complex allegations, voluminous records, disability, or other circumstances affecting the ability to prepare a meaningful defense.

Must the employer provide every document in its possession?

There is no universal rule requiring unrestricted disclosure of the entire investigation file. However, the notice and process must disclose enough factual detail to permit an intelligent defense. Withholding the substance of the accusation while expecting a meaningful answer may defeat due process. Confidentiality and privacy concerns should be managed through proportionate access or redaction, not by making the charge impossible to answer.

Is a face-to-face hearing mandatory?

Not in every case. A meaningful written opportunity to answer can be sufficient. A hearing or conference becomes particularly important when requested in writing, required by company rules or a collective bargaining agreement, or needed to resolve substantial evidentiary disputes.

Can an employee bring a lawyer or union representative?

An employee may seek assistance in preparing a defense. Representation at a conference depends on the applicable rules, collective bargaining agreement, company procedure, and circumstances. The employee should request representation in writing if it is needed.

Can falsifying one record justify dismissal?

Possibly, especially when the act is intentional, work-related, material, and incompatible with a position of trust. But there is no automatic rule that every incorrect entry warrants dismissal. Intent, duties, circumstances, evidence, company policy, proportionality, and consistent enforcement matter.

Must the employer prove actual financial loss?

Not always. A willful betrayal of trust may be serious even if the scheme was caught before money was lost. The employer must still prove the underlying act and its connection to the employee’s duties.

Can the employee be dismissed while a criminal case is pending?

Yes, if the employer independently observes due process and has substantial evidence of a valid just cause. A criminal conviction is not a prerequisite to employment discipline.

Does acquittal automatically require reinstatement?

No. Criminal and labor cases apply different standards and may reach different outcomes. The legality of dismissal depends on the evidence and process in the employment case.

Do these rules apply to government employees?

Not directly. National and local government personnel are generally governed by civil-service laws, the applicable Rules on Administrative Cases in the Civil Service, agency rules, and other public-sector requirements. Government employees should consult the current rules governing their particular office and status.

Official legal sources

This article provides general legal information, not advice for a particular investigation or case. Outcomes depend on the employee’s status, documents, company and union rules, evidence, and procedural history. Official sources were checked for currency on August 27, 2026.