Quick answer
Yes. A Philippine private-sector employer may investigate suspected employee fraud, dishonesty, or falsified records and may impose discipline—including dismissal—if the evidence and the applicable legal ground justify it. But an accusation, audit finding, or suspicious document does not by itself make dismissal lawful.
When dismissal for a just cause is being considered, the employer must satisfy both substantive due process and procedural due process. There must be a valid just cause under Article 297 of the Labor Code supported by substantial evidence, and the employee must generally receive: a detailed first written notice, at least five calendar days from receipt to submit an explanation, a meaningful opportunity to be heard, and—if dismissal is ultimately justified—a second written notice explaining the decision. (Judiciary eLibrary)
Fraud or falsification can amount to a just cause, but the result depends on what was falsified, why it was done, whether it was intentional, whether it was connected with the employee's work, whether anyone obtained or stood to obtain a benefit, the employee's actual duties and position of trust, the company's lawful rules, and the strength of the proof. The Supreme Court has repeatedly cautioned that loss of trust cannot rest on suspicion or be used as an after-the-fact excuse for a dismissal. (Judiciary eLibrary)
The two things an employer must prove
A lawful dismissal for employee fraud normally has two separate components. Getting one right does not cure failure on the other.
Substantive due process: there must actually be a lawful ground
Article 297 of the Labor Code allows termination for specified just causes, including serious misconduct and "fraud or willful breach" of the employer's trust. It also recognizes other statutory grounds such as gross and habitual neglect, commission of certain crimes or offenses against the employer or specified persons, and causes analogous to the enumerated grounds. (Judiciary eLibrary)
For fraud or willful breach of trust, Department Order No. 147-15 states that there must be an act, omission, or concealment involving a breach of a legal duty, trust, or confidence justly reposed in the employee, committed against the employer or its representative, and connected with the employee's work. (Judiciary eLibrary)
The employer bears the burden of proving the lawful basis for dismissal. In labor cases, the required evidentiary standard is generally substantial evidence rather than proof beyond reasonable doubt. A sincere suspicion, an accusation standing alone, or a conclusion unsupported by underlying facts is not enough. (Judiciary eLibrary)
Procedural due process: the employee must be allowed to answer the case
For termination based on a just cause, Department Order No. 147-15 requires two written notices with an opportunity to be heard between them. The procedure is not satisfied merely by telling the employee verbally that management believes fraud occurred. (Judiciary eLibrary)
The process should be genuine. Management should investigate before reaching a final conclusion, consider the employee's explanation and evidence, and decide the case on the record rather than use the notices merely to document a decision already made.
A defensible investigation process
1. Secure the records before deciding who is responsible
Preserve the original records and reliable copies before documents, system entries, or physical evidence can be altered or lost. Depending on the allegation, relevant evidence may include:
- original invoices, receipts, vouchers, purchase orders, time records, payroll records, inventory records, expense claims, or signed forms;
- accounting entries and reconciliation reports;
- system, audit, access, edit, and login logs;
- relevant work email or business-system messages;
- approval histories and segregation-of-duties records;
- CCTV or access-control records, if lawfully obtained and relevant;
- written policies, job descriptions, authority matrices, and prior instructions;
- witness statements or contemporaneous incident reports; and
- records showing who created, changed, approved, received, or benefited from the questioned transaction.
Do not alter the originals merely to mark them for the investigation. Keep a record of where important evidence came from, when it was obtained, and who handled it.
Digital evidence deserves particular care. A screenshot may show what appeared on a screen but may not establish who made the entry or whether the underlying record was later altered. Where possible, retain the underlying system record, timestamps, account information, audit trail, and other corroborating evidence.
Investigations involving personal information must also comply with the Data Privacy Act. Personal data processing must have a lawful basis and remain consistent with transparency, legitimate purpose, and proportionality. An investigation is not a license to collect every piece of private information that can technically be accessed. (Privacy Commission)
2. Separate facts from suspicions
Before issuing a charge, identify exactly what the evidence presently shows. For example, distinguish among a false entry, an unauthorized correction, an accounting error, an altered document, use of another person's credentials, intentional concealment, and misappropriation.
Those are not legally interchangeable.
Ask what fact can be proved for each allegation, what inference management is drawing from that fact, and whether another reasonable explanation remains possible. If an audit identifies a discrepancy but not the responsible person, the audit may establish that something went wrong without yet establishing who committed fraud.
3. Identify the correct legal and company-rule ground
Avoid using broad labels such as "fraud," "dishonesty," or "loss of trust" without identifying the conduct supposedly supporting them.
If the charge is serious misconduct, the misconduct must be sufficiently grave, connected with the employee's work, and of a character demonstrating unfitness for continued employment. (Judiciary eLibrary)
If management relies on loss of trust and confidence, the employee's actual duties matter. Supreme Court jurisprudence recognizes managerial employees and fiduciary rank-and-file employees—such as cashiers, auditors, property custodians, or employees who routinely handle significant amounts of money or property—as the principal categories of employees occupying positions of trust for this purpose. A job title alone is not controlling; the nature of the work matters. (Judiciary eLibrary)
For fiduciary rank-and-file employees, mere uncorroborated accusation is particularly inadequate. Their actual involvement in the alleged wrongdoing must be established. Even for managerial employees, loss of trust cannot rest on whim, caprice, or unsupported suspicion. (Judiciary eLibrary)
Review the employment contract, handbook, code of conduct, disciplinary matrix, applicable collective bargaining agreement, and established company practice before choosing a charge or penalty.
4. Issue a specific first written notice
If the evidence may justify dismissal, the first notice—often called a notice to explain or NTE—should comply with Department Order No. 147-15.
It should identify the specific legal ground and relevant company rule, describe the material facts and circumstances in enough detail for the employee to understand and intelligently answer the accusation, and direct the employee to submit an explanation. A generic accusation such as "you committed fraud and dishonesty" is not enough. (Judiciary eLibrary)
The notice should ordinarily state relevant dates, transactions, records, amounts or items involved where material, and the employee's alleged participation. The employer does not need to write its entire eventual decision in the first notice, but it must disclose enough factual substance to make the opportunity to defend meaningful.
5. Give at least five calendar days to explain
The employee must be given a reasonable period to prepare a response. Under Department Order No. 147-15 and Supreme Court jurisprudence, this means at least five calendar days from receipt of the first notice. The period exists so the employee can study the accusation, consult a lawyer or union officer, gather evidence, and determine the defenses to raise. (Judiciary eLibrary)
The five-day rule is a minimum, not an instruction to rush every case on the fifth day. Complex allegations involving lengthy audit reports or numerous transactions may justify more time, especially if fairness, a CBA, or company rules require it.
The relevant starting point is receipt of the notice. Employers should therefore preserve reliable proof of service.
6. Give a meaningful opportunity to be heard
Due process does not require a courtroom-style trial in every disciplinary case. An employee may be given a meaningful opportunity to answer through a written explanation, conference, hearing, or another fair and reasonable procedure.
Under Department Order No. 147-15, however, a formal hearing or conference becomes mandatory when the employee requests one in writing, substantial evidentiary disputes exist, a company rule or practice requires one, or similar circumstances justify it. The employee may be assisted by a representative if desired. (Judiciary eLibrary)
Where credibility is central—for example, two employees give materially conflicting accounts about who authorized a transaction—a conference may also make the investigation more reliable even apart from the minimum statutory requirement.
7. Investigate the employee's defense instead of merely receiving it
An NTE process becomes vulnerable if the employee's answer is collected but never genuinely considered.
If the employee produces a different version of a receipt, approval email, system log, witness, delegation of authority, or explanation of an accounting procedure, verify it. If the employee identifies another person who had the same system access, check that claim. If management believes a submitted document is itself falsified, preserve it and investigate that new allegation fairly.
Material new accusations discovered during an investigation generally should not be hidden until the termination letter. If management intends to rely on new conduct that the employee has not had a meaningful opportunity to answer, due process considerations favor giving the employee notice of the additional charge and a fair opportunity to respond.
8. Decide on evidence, not on the seriousness of the accusation
Fraud is a serious word, but the seriousness of the label does not reduce the need for proof.
The final decision should identify which material facts were established, the evidence supporting them, how the employee's defenses were evaluated, the applicable law and company rules, and why the selected penalty is justified.
Also check proportionality and the employer's own disciplinary rules. Falsification does not mechanically require dismissal in every situation. In one Supreme Court case involving falsified company records, the employer's own disciplinary rules distinguished falsification where someone benefited or would have benefited from falsification from falsification without such benefit; the Court rejected treating the proven conduct as a different, more serious offense that automatically warranted discharge. The lesson is not that falsification is minor, but that employers must prove the offense actually charged and apply the applicable rules to the facts proved. (Judiciary eLibrary)
9. Issue the second written notice only after considering the case
If management concludes that dismissal is justified, it must serve a written termination notice stating, in substance, that the circumstances surrounding the charge have been considered and that grounds have been established to justify termination. (Judiciary eLibrary)
A termination notice should make the decision understandable. It should not merely state "your explanation is unsatisfactory" without identifying what was proved and why the defense failed on the material issues.
Department Order No. 147-15 provides that the required notices are to be served personally on the employee or at the employee's last known address. Employers should maintain documentation of service. (Judiciary eLibrary)
When preventive suspension is allowed
Preventive suspension is not an automatic consequence of an accusation of fraud.
Under the Omnibus Rules Implementing the Labor Code, an employer may place an employee under preventive suspension when the employee's continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. Its purpose is protective while an investigation is underway, not to punish an employee before liability has been established. (Judiciary eLibrary)
In a fraud investigation, the required threat may potentially exist where the employee's continued access creates a serious and imminent risk to company funds, records, inventory, systems, or other property. But the employer should be able to explain that risk based on the facts. Merely alleging misconduct is insufficient. The Supreme Court has required employers to substantiate why continued presence posed the serious and imminent threat required by the rule. (Judiciary eLibrary)
Preventive suspension generally cannot last longer than 30 days. After that period, the employee must be reinstated to the former or a substantially equivalent position, or the suspension may be extended provided wages and other benefits are paid during the extension. (Judiciary eLibrary)
The 30-day rule is a limitation on preventive suspension. It is not a universal 30-day deadline for every internal investigation where the employee remains at work.
When an employee is preventively suspended, however, the employer should move the investigation promptly. Supreme Court decisions have emphasized completing the investigation within the permitted suspension period or reinstating the employee, including through payroll reinstatement where appropriate, if the investigation extends beyond that period. (Judiciary eLibrary)
Does falsifying a record automatically justify dismissal?
No. It may justify dismissal, but the legal conclusion depends on the facts proved.
Intent is often critical. A willful breach is distinguished from conduct done carelessly, inadvertently, or through mere error. The Supreme Court describes a willful breach as one committed intentionally, knowingly, and purposely, without justifiable excuse. (Judiciary eLibrary)
Materiality matters as well. Altering an insignificant clerical entry for an innocent reason is not automatically equivalent to manufacturing a reimbursement claim, falsifying sales records to conceal collections, changing payroll data for personal gain, or falsifying reports to conceal a shortage.
The employee's duties matter. An intentional falsification by a cashier, finance manager, auditor, warehouse custodian, or other employee entrusted with significant money or property may directly implicate the trust essential to the position. For an employee who does not occupy such a role, the employer should carefully determine whether another just cause—such as serious misconduct or violation of a valid company rule—actually fits the established facts rather than loosely invoking "loss of trust." (Judiciary eLibrary)
Past offenses may sometimes be relevant to the appropriate penalty when properly established, but they should not be used to manufacture proof that the present accusation occurred.
Is a criminal conviction required?
No. An employer does not generally have to obtain a criminal conviction before imposing employment discipline supported by the evidence and labor law.
Criminal proceedings require proof beyond reasonable doubt, while labor cases generally apply the lower substantial-evidence standard. The Supreme Court has therefore held that an acquittal in a criminal case does not necessarily prevent a finding that an employee's misconduct was sufficiently established for employment purposes. (Judiciary eLibrary)
The reverse is also important: filing a police or criminal complaint does not itself prove lawful dismissal. The employer must still satisfy the substantive and procedural standards governing the employment decision.
Where the facts may lead to both dismissal and criminal proceedings, obtaining legal advice early is prudent because interviews, admissions, document handling, access to electronic evidence, and communications with law enforcement can affect more than the labor case.
Privacy and confidentiality during the investigation
Fraud investigations frequently involve sensitive information about the accused employee, witnesses, customers, suppliers, and other employees.
Access to investigation records should therefore be limited to people with a legitimate role in the matter. Employers should avoid circulating accusations, evidence, or investigation reports more widely than necessary.
The Data Privacy Act requires personal-data processing to be lawful, adequate, relevant, and proportionate to its legitimate purpose. Information should not be collected merely because it may be interesting, nor retained indefinitely without a lawful reason. (Privacy Commission)
This is especially important when reviewing communications, devices, CCTV, biometrics, health information, financial information, or data about people who are not themselves under investigation.
Common mistakes that make a fraud dismissal vulnerable
One recurring mistake is deciding first and investigating afterward. A notice to explain should start or form part of a genuine adjudicative process, not merely create paperwork for a predetermined termination.
Another is issuing a vague NTE. The employee must be told the particular acts or omissions and the factual circumstances supporting the charge—not simply that management has "lost trust."
Giving less than five calendar days from receipt of the first notice is another avoidable problem when dismissal for just cause is contemplated.
Employers also run into difficulty when they equate an accounting discrepancy with fraud without proving intentional employee involvement, rely on an unsigned or uncorroborated accusation, ignore evidence that several people had the same access, or fail to preserve the original records behind screenshots and spreadsheets.
Another common error is using preventive suspension simply because the charge sounds serious. The legal test concerns the serious and imminent threat created by continued employment, not the label placed on the accusation.
Employers should also avoid imposing dismissal for an offense different from the one proved, overlooking a disciplinary matrix or CBA, or invoking loss of trust against an employee whose actual position does not satisfy the doctrine.
Finally, skipping the second written notice after an investigation remains a due-process violation even when the underlying misconduct is ultimately proved.
What happens if the fraud is proved but due process was defective?
A failure to follow procedural due process does not necessarily make a dismissal illegal when a genuine just cause was independently proved.
Under prevailing Supreme Court jurisprudence, where dismissal is substantively justified by a just cause but the employer violated the required dismissal procedure, the dismissal may remain effective but the employer may be ordered to pay ₱30,000 in nominal damages for the procedural violation. The Supreme Court reaffirmed that rule in a recent decision applying the twin-notice requirement. (Judiciary eLibrary)
That rule should not be understood as permission to "dismiss now and pay later." Due process remains mandatory.
If the employer cannot establish a just cause at all, the problem is substantive rather than merely procedural. An illegally dismissed regular employee may be entitled under Article 294 of the Labor Code to reinstatement without loss of seniority rights and full backwages and other benefits; depending on the circumstances and the eventual adjudication, separation pay in lieu of reinstatement may apply where actual reinstatement is no longer feasible. (Judiciary eLibrary)
If you are the employee being investigated
Read the NTE carefully and note the exact date you received it. Do not assume that a request for an explanation is already a lawful dismissal.
Ask for enough information to understand each allegation. Prepare a chronological, factual response rather than an emotional one. Address each transaction or document separately where possible and attach records that support your explanation.
Preserve your own lawful copies of relevant employment records, notices, written explanations, policies, schedules, payslips, emails or business communications already available to you, and proof showing when documents were sent or received. Do not destroy, alter, secretly take, or improperly access company data in an attempt to defend yourself.
If a material factual dispute requires a conference, consider requesting a hearing or conference in writing. If you are represented by a union, contact the union promptly and check the CBA's disciplinary and grievance provisions.
If you receive a termination notice, keep the envelope, delivery record, email headers where applicable, and the complete notice. The exact dates may later matter.
If you are the employer conducting the investigation
Keep the people who gather evidence separate, where practicable, from those whose personal interests are implicated in the allegation. Record the evidence both for and against the charge.
Before dismissal, ask four questions: What precise misconduct was proved? What reliable evidence proves it? Which Labor Code ground and company rule actually apply? And has the employee had a genuine opportunity to answer the material case relied upon?
For suspected falsification, obtain the best available underlying record instead of relying only on a summary spreadsheet. Determine who had authority and system access, whether alterations were permitted, whether the disputed transaction produced a benefit or concealed a shortage, and whether the employee's explanation is consistent with surrounding records.
A well-documented finding based on verified facts is considerably safer than a lengthy decision filled with conclusions but little supporting evidence.
Special situations and exceptions
These rules primarily address private-sector employment governed by the Labor Code. Government personnel are subject to separate civil-service, administrative, and other applicable rules, so the process should not automatically be copied from a private-company investigation.
A collective bargaining agreement may impose additional disciplinary procedures, representation rights, grievance machinery, or deadlines. Department Order No. 147-15 recognizes the role of the CBA and provides that disputes in organized establishments are to undergo the applicable grievance machinery. (Judiciary eLibrary)
Company policies may also give employees protections beyond the statutory minimum. Employers should ordinarily comply with their own valid disciplinary procedures because ignoring them can create additional issues.
Probationary employment presents another distinction. Termination solely for failure to meet reasonable standards made known at engagement is governed by rules different from dismissal for employee fraud. If the probationary employee is instead being dismissed for a just cause such as serious misconduct or fraud, the employer should analyze the case as a just-cause dismissal rather than disguise it as simple failure to qualify.
When legal help is urgent
For an employee, obtaining advice promptly is sensible when the NTE alleges theft, fraud, falsification, cybercrime, estafa, qualified theft, or another possible criminal offense; when management is demanding a sworn admission; when access to records needed for the defense is disputed; when preventive suspension is approaching or exceeding 30 days; when termination has already occurred; or when union/CBA deadlines may apply.
For an employer, early counsel is particularly valuable when the suspected loss is substantial, several employees may be involved, the evidence comes from personal devices or communications, criminal referral is being considered, the employee is a union officer or covered by special CBA protections, the investigation crosses jurisdictions, or digital evidence may need forensic preservation.
The point is not to turn every internal investigation into litigation. It is to avoid irreversible mistakes when employment rights, reputations, significant losses, privacy interests, or possible criminal liability are all involved.
Challenging or resolving a termination dispute
Termination disputes are generally subject to the Philippine Single Entry Approach (SEnA) conciliation-mediation process before proceeding to the proper labor forum, subject to statutory exceptions. Republic Act No. 10396 institutionalized mandatory conciliation-mediation, and DOLE states that SEnA ordinarily provides a 30-calendar-day conciliation-mediation period. (Lawphil)
As of the source check for this article, DOLE's Assistance for Request Management System allows Requests for Assistance to be filed online, while onsite filing is available through designated DOLE, NCMB, and NLRC offices. (DOLE ARMS)
A dismissed employee should not treat the availability of conciliation as a reason to ignore legal prescriptive periods. Supreme Court jurisprudence generally treats an action for illegal dismissal as subject to a four-year prescriptive period from accrual of the cause of action, while particular monetary claims may be governed by different periods. (Judiciary eLibrary)
Because jurisdiction, grievance procedures, prescription, and available remedies can depend on the precise claim and employment arrangement, anyone approaching a deadline should obtain case-specific advice rather than rely on the general periods alone.
FAQ
Can the company terminate an employee immediately after discovering a fake document?
Generally, not merely because management believes the document is fake. If dismissal for a just cause is contemplated, the employer still needs a legally sufficient ground, substantial evidence tying the employee to the misconduct, and the required notice-and-opportunity-to-be-heard process. A lawful preventive suspension may be available where the separate serious-and-imminent-threat test is satisfied.
Does the employee have exactly five days to answer an NTE?
The rule is at least five calendar days from receipt when the NTE is part of a contemplated just-cause termination. An employer may allow more time. A CBA, company rule, or circumstances of a complex investigation may also affect the appropriate period. (Judiciary eLibrary)
Is an administrative hearing always required?
No. A meaningful written opportunity to answer may satisfy due process in appropriate cases. Under Department Order No. 147-15, a formal hearing or conference becomes mandatory when requested by the employee in writing, when substantial evidentiary disputes exist, when company rules or practice require it, or when similar circumstances justify one. (Judiciary eLibrary)
Can an employee bring a lawyer to the company investigation?
The governing rules recognize an opportunity for the employee to consult or be represented by a lawyer or union officer and to receive the assistance of a representative if desired. The exact mechanics of participation can also depend on the CBA and company procedure. (Judiciary eLibrary)
Can management suspend the employee while investigating fraud?
Only when the legal conditions for preventive suspension are met. Continued employment must pose a serious and imminent threat to the life or property of the employer or co-workers. Preventive suspension generally cannot exceed 30 days without the reinstatement or paid-extension consequences provided by the rules. (Judiciary eLibrary)
Can a first offense involving falsification result in dismissal?
Potentially, yes, if the proven conduct satisfies a lawful just cause and the penalty is warranted under the facts and applicable rules. But "falsification" is not an automatic shortcut to dismissal. Intent, materiality, benefit, the employee's responsibilities, company policies, and surrounding circumstances can all matter.
What if the employee refuses to submit a written explanation?
The employer should document that the employee received a proper notice and was genuinely afforded the required opportunity to respond. An employee generally cannot stop an investigation indefinitely simply by declining to participate, but management must still prove the charge with sufficient evidence; silence is not a substitute for proof.
Does an acquittal in a criminal case mean the employee must be reinstated?
Not necessarily. Criminal liability and employment liability apply different standards of proof. A dismissal may be supported by substantial evidence even where guilt was not established beyond reasonable doubt, although the employer must still independently prove the valid employment ground and due-process compliance. (Judiciary eLibrary)
Can an employer dismiss someone for "loss of trust" without proving actual theft?
Actual theft or a criminal conviction is not always required, but loss of trust cannot be speculative. The employer must establish facts giving a legitimate basis for the loss of confidence, and the doctrine applies particularly to employees occupying positions of trust. For fiduciary rank-and-file employees, uncorroborated allegations are insufficient. (Judiciary eLibrary)
Where can an employee or employer ask DOLE for preliminary guidance?
DOLE operates SEnA for labor disputes and, as of 2026, also maintains an official online legal-query service for preliminary labor-law guidance. The legal-query portal does not replace formal complaint or adjudication procedures. (Department of Labor and Employment)
Official sources
Department of Labor and Employment — Department Order No. 147-15
Supreme Court E-Library — Department Order No. 147-15 full text
Supreme Court E-Library — King of Kings Transport, Inc. v. Mamac
Supreme Court E-Library — Distribution & Control Products, Inc. v. Santos
Supreme Court E-Library — Angeles v. St. Catherine Realty Corporation
Department of Labor and Employment — Single Entry Approach (SEnA)
DOLE Assistance for Request Management System — online SEnA filing
National Privacy Commission — Data Privacy Act of 2012
General-information disclaimer
This article provides general Philippine legal information, not legal advice for a particular investigation, employee, employer, or dispute. The correct outcome can depend on the actual evidence, employment status, job duties, company rules, CBA provisions, contracts, notices, dates, and other documents. Consult qualified Philippine labor counsel or the appropriate government office for advice on a specific case.
Sources and procedures checked through August 26, 2026.