Quick answer

A Philippine private-sector employer may investigate suspected employee fraud or falsified records and, if the evidence supports it, impose discipline up to dismissal. But dismissal is lawful only when both requirements are met:

Substantive due process: the employer proves a just cause under Article 297 of the Labor Code—commonly fraud, willful breach of trust, serious misconduct, or an analogous cause—by substantial evidence; and
Procedural due process: the employee receives a sufficiently detailed first written notice, at least five calendar days to submit a written explanation, a meaningful opportunity to be heard, and a written notice of the final decision.

A suspicion, audit variance, anonymous accusation, or irregular document does not by itself prove fraud. The employer must establish the employee’s own intentional or knowing participation and connect the charge to the employee’s work. An honest mistake, clerical error, weak control system, or negligence is not automatically fraud.

These rules principally concern private-sector employment. Government personnel are also subject to constitutional due process, but administrative cases against them are governed by civil-service laws and agency-specific rules.

What must the employer prove?

Article 297(c) of the Labor Code recognizes “fraud or willful breach” of the employer’s trust as a just cause for termination.

Fraud generally involves a dishonest act showing an intention to deceive, defraud, or betray the employer. Examples may include deliberately:

Fabricating receipts, time records, expense claims, sales reports, inventory documents, medical certificates, or employment credentials;
Altering figures, dates, approvals, signatures, or electronic entries;
Creating fictitious transactions, employees, customers, or vendors;
Concealing shortages or unauthorized disbursements;
Submitting a record known to be false; or
Helping another person create, approve, process, or conceal false records.

The exact legal ground depends on the proven facts. One incident may potentially fall under fraud, willful breach of trust, serious misconduct, or a valid company rule. The employer should identify the correct ground instead of merely listing every possible offense.

Fraud or willful breach of trust

For loss of trust and confidence to justify dismissal:

The employee must occupy a position of trust or regularly handle significant money, property, records, approvals, or other sensitive matters;
A work-related act must exist that reasonably justifies the loss of trust;
The breach must be intentional, knowing, and purposeful, without a justifiable excuse; and
The finding must rest on clearly established facts and substantial evidence—not whim, suspicion, or a convenient label.

The Supreme Court applied these requirements in San Miguel Corporation v. Gomez, G.R. No. 200815, August 24, 2020.

Rank-and-file employees are not automatically outside this ground. Cashiers, auditors, property custodians, payroll personnel, accounting staff, or others who routinely handle significant assets or sensitive records may occupy positions of trust even if they are not managers. Conversely, an employer cannot rely on “loss of confidence” without proving both the employee’s trusted role and the act that betrayed that trust.

Serious misconduct

Falsification may also constitute serious misconduct when the conduct:

Is grave rather than trivial;
Relates to the performance of the employee’s duties and demonstrates unfitness to remain employed; and
Was committed with wrongful intent.

Carelessness or poor judgment, without wrongful intent, does not ordinarily meet those elements.

The required standard is substantial evidence

An internal employment case does not require proof beyond reasonable doubt. The employer must produce substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support the conclusion.

This is lower than the criminal standard, but it is still a real evidentiary burden. The employer bears the burden of proving a valid cause once dismissal is established. The Supreme Court has emphasized that disciplinary action may be supported by substantial proof rather than criminal-level proof in Arcilla v. DBP Service Corporation, G.R. No. 225125, June 6, 2018.

A legally sound investigation process

1. Secure the evidence without deciding guilt in advance

Preserve relevant records as soon as an irregularity is discovered. Depending on the case, these may include:

Original paper records and certified or authenticated copies;
Audit trails, system logs, access histories, and version histories;
Emails, approved workplace messages, and transaction records;
CCTV footage obtained and used lawfully;
Specimen signatures or authentic comparison records;
Written policies, job descriptions, delegation matrices, and approval limits;
Witness statements based on personal knowledge;
Accounting reconciliations and audit work papers; and
Records showing when, where, and by whom a document was created, changed, approved, or submitted.

Keep a preservation log identifying the source, collector, date, storage location, and any transfer or copying of evidence. Preserve native electronic files and metadata when practicable. Avoid editing, annotating, or repeatedly resaving the only copy.

Access should be limited to people who genuinely need the information. The Data Privacy Act and its Implementing Rules and Regulations require personal-data processing to be transparent, for a legitimate purpose, and proportionate. An investigation does not create an unlimited right to search or circulate employees’ personal information.

2. Conduct a neutral preliminary assessment

Before accusing anyone, determine:

What record is allegedly false;
What information was changed or fabricated;
Who had access and authority;
Whether the system permits shared credentials or undocumented changes;
Whether the discrepancy may have resulted from error, training gaps, system failure, or an unclear procedure;
What loss, risk, or concealment resulted; and
What company rule or Labor Code ground may apply.

The investigator should distinguish evidence from inference. A person who encoded, transmitted, or approved a record is not necessarily the person who falsified it. Shared passwords, automated entries, delegated tasks, and defective controls may materially affect responsibility.

Where possible, avoid assigning the final decision to a person who is a complainant, material witness, or personally involved in the disputed transaction. Absolute institutional separation is not always possible, but the process must remain genuinely open to the employee’s defense.

3. Consider preventive suspension only when justified

Preventive suspension is not an automatic response to a fraud allegation and should not be used as punishment before a finding of liability.

It may be imposed when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. In dishonesty cases, access to documents, systems, funds, or witnesses may support suspension when it creates a real risk to property or the integrity of vital evidence.

Preventive suspension generally may not exceed 30 days. If the investigation remains unfinished after that period, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the employee’s wages and benefits during the extension. The governing principles are discussed in Pacific Royal Basic Foods, Inc. v. Noche, G.R. No. 227718, November 11, 2021.

The suspension notice should state its non-disciplinary purpose, factual basis, start date, and expected duration. Alternatives such as temporary reassignment, removal of system access, dual approval, or supervised work may be more proportionate.

4. Serve a detailed first notice

If the preliminary evidence supports a formal charge, give the employee a written notice to explain. Under DOLE Department Order No. 147-15, the notice should contain:

The specific just cause under Article 297 and any applicable company rule;
A detailed narration of the relevant acts, dates, transactions, documents, amounts, and circumstances;
The employee’s alleged participation;
A directive to submit a written explanation; and
A response period of at least five calendar days from receipt.

Five calendar days is the minimum reasonable period, not five working days. A longer period may be necessary when records are voluminous, the issues are technical, the employee reasonably needs access to documents, or a collective bargaining agreement or company rule grants more time.

A notice saying only “fraud,” “dishonesty,” “falsification,” or “loss of trust” is inadequate. The employee must be able to understand and answer the actual accusation.

The employer should keep reliable proof of service. The rules contemplate personal service or service at the employee’s last known address. If the employee refuses to receive or sign, document the attempted service through witnesses, delivery records, or another reliable method consistent with company rules and applicable law. Refusal to sign is not, by itself, an admission of guilt.

5. Give meaningful access and an opportunity to answer

Due process requires a real opportunity to defend, not a ritual request for an explanation after management has already decided the outcome.

The employee should be allowed to:

Explain the transaction and identify supporting records;
Challenge the authenticity, completeness, or interpretation of the employer’s evidence;
Submit documents and witness statements;
Identify relevant records within the employer’s control;
Explain system access, approval practices, or shared responsibilities; and
Obtain assistance from a representative, lawyer, or union officer if desired and consistent with the governing rules.

The employer need not conduct a courtroom trial. A meaningful written opportunity may suffice. A formal hearing or conference becomes mandatory when:

The employee requests it in writing;
Substantial factual or evidentiary disputes exist;
A company rule, contract, collective bargaining agreement, or established practice requires it; or
Similar circumstances make a conference necessary for a fair resolution.

These requirements are summarized in King of Kings Transport, Inc. v. Mamac, G.R. No. 166208, June 29, 2007 and reflected in DOLE Department Order No. 147-15.

If the employee does not respond, the employer may generally decide on the available evidence—but only after proving proper notice and a genuine opportunity to answer. Silence does not cure vague charges or weak evidence.

6. Investigate the employee’s defenses

Fair consideration may require the employer to:

Check the records or witnesses identified by the employee;
Reconcile contradictory system logs or audit findings;
Determine whether other users had the same access;
Verify whether an approval or instruction actually came from a supervisor;
Examine whether the disputed document was final, a draft, or system-generated;
Obtain technical or handwriting assistance when authenticity cannot responsibly be assessed internally; and
Separate proven acts from unsupported allegations.

The employer should not rely on a confession obtained through intimidation, threats, deception about legal consequences, or a forced resignation. Any admission should be recorded accurately and evaluated together with the surrounding evidence.

7. Make findings charge by charge

The decision-maker should assess:

Whether the document or entry was actually false;
Whether the employee created, altered, used, approved, or concealed it;
Whether the employee knew it was false;
Whether intent to deceive or betray the employer is supported by the evidence;
Whether the act was work-related;
Whether the employee occupied a position of trust;
Whether the evidence supports the cited company rule;
Whether an innocent or less culpable explanation remains reasonably consistent with the records; and
Whether the proposed penalty is authorized and proportionate.

A disciplinary decision should rest on the charge stated in the first notice. Dismissing an employee for a new or materially different offense that was never charged deprives the employee of an opportunity to defend against it. If the investigation reveals another charge, issue a proper supplemental or new notice and allow a fresh response.

8. Serve a reasoned second notice

If discipline is warranted, serve a written decision stating:

The charge considered;
The material facts established;
The employee’s principal defenses and how they were evaluated;
The evidence supporting the finding;
The applicable rule or just cause;
The penalty and its effectivity; and
Any internal appeal or review procedure.

For dismissal, the notice must show that the circumstances were considered and that grounds sufficient to sever employment were established. A bare statement that management “lost confidence” is risky.

If the evidence does not establish the charge, close the case, lift preventive measures, restore access or duties as appropriate, and correct records that inaccurately imply guilt.

Does every falsified record justify dismissal?

No. The answer depends on the employee’s intent, participation, duties, the character of the record, applicable rules, and the surrounding circumstances.

Dismissal may be supportable where substantial evidence establishes deliberate falsification or use of a record to deceive the employer, especially when the employee handles money, property, approvals, compliance records, or other matters requiring trust.

Dismissal may be unjustified where the evidence establishes only:

A typographical or encoding mistake;
An unclear instruction or inconsistent procedure;
Negligence without fraudulent intent;
A record altered by another user;
Reliance on information reasonably believed to be accurate;
An immaterial discrepancy with no evidence of deception; or
Suspicion based only on the employee’s access or position.

An employer may still address proven negligence or a policy violation, but it must charge and evaluate the correct offense. It should not convert every error into fraud simply to support the maximum penalty.

Must the employer prove an actual financial loss?

Not necessarily. A deliberate falsification can seriously damage the employment relationship even when the attempted transaction is detected before money is released. But the absence of loss, the materiality of the falsehood, and the employee’s actual intent remain relevant to the factual and proportionality analysis.

The employer should avoid treating an estimated loss as established unless the method and supporting records can be explained and tested.

Is a criminal case required before dismissal?

No. An employer does not need to obtain a prosecutor’s finding or criminal conviction before deciding an employment case. The proceedings have different purposes and standards of proof.

Likewise, dismissal of a criminal complaint or an acquittal does not automatically establish that the employment dismissal was valid or invalid. The labor case must stand on the evidence presented under the substantial-evidence standard.

Some falsified documents may potentially fall under Articles 171 or 172 of the Revised Penal Code, as amended. Criminal liability depends on the document’s classification, the accused’s capacity, the particular falsifying act, intent, damage where legally required, and other elements. Employers should obtain legal advice before filing a criminal complaint and should not use the threat of prosecution to force a resignation or waiver.

Data privacy and confidentiality

Investigation records frequently contain payroll data, signatures, identification details, health information, banking information, communications, and allegations affecting reputation. Employers should:

Define and document the legitimate investigative purpose;
Collect only information relevant and necessary to that purpose;
Restrict access to authorized investigators and decision-makers;
Use secure transfer and storage methods;
Avoid circulating allegations to uninvolved employees;
Redact irrelevant personal information where possible;
Retain records only as long as justified by law, policy, or a legitimate legal need; and
Securely dispose of records when retention is no longer justified.

Confidentiality should protect the process, not prevent the employee from understanding the accusation or presenting a defense. A blanket instruction prohibiting the employee from consulting a lawyer, union officer, or authorized representative may undermine the opportunity to be heard.

Evidence each side should preserve

For employers

Preserve:

The original questioned record and its source;
Audit trails, metadata, and access logs;
Policies effective on the date of the alleged act;
Proof that the employee received or knew the policy;
Job descriptions and authority matrices;
All notices, responses, minutes, and proof of service;
The evidence considered, including material evidence favorable to the employee;
The basis for any preventive suspension; and
A clear chronology of the investigation and decision.

For employees

Keep lawful copies of:

The notice to explain, suspension notice, and termination letter;
Your written explanation and proof of submission;
Relevant payslips, schedules, approvals, instructions, and workplace correspondence;
Requests for documents, extensions, representation, or a hearing;
The applicable handbook, policy, contract, and collective bargaining agreement;
Names of witnesses with personal knowledge;
Delivery envelopes, courier records, and screenshots showing dates of receipt; and
Notes of meetings, including attendees and material statements.

Do not delete, alter, conceal, or remove company records without authority. Preserve evidence lawfully and request access through proper channels.

Common mistakes that undermine an investigation

Employers commonly create legal risk by:

Announcing guilt before receiving the employee’s explanation;
Using a generic notice with no detailed facts;
Giving fewer than five calendar days to respond;
Counting the response period before actual receipt;
Withholding enough information to make a meaningful defense impossible;
Treating failure to sign a notice as an admission;
Relying solely on accusation, hearsay, or unexplained audit conclusions;
Assuming that access to a system proves authorship;
Ignoring shared credentials, delegation, or control failures;
Charging negligence but dismissing for fraud, or vice versa;
Introducing new grounds only in the termination letter;
Refusing a written request for a hearing despite substantial factual disputes;
Using preventive suspension automatically or beyond 30 days without the required reinstatement or pay;
Pressuring the employee to resign;
Publicizing unproven accusations; or
Applying a penalty inconsistent with the policy, contract, CBA, or comparable cases without a defensible reason.

Employees also weaken their position when they ignore notices, respond only verbally, miss deadlines without requesting an extension, delete messages, sign inaccurate minutes without qualification, or submit altered evidence.

What happens if there was a valid cause but defective procedure?

A valid cause and proper procedure are separate questions. Under Agabon v. NLRC, G.R. No. 158693, November 17, 2004, a dismissal supported by just cause is not automatically invalid merely because the employer failed to follow statutory procedure. The employer may nevertheless be liable for nominal damages for violating the employee’s procedural rights. The Supreme Court has commonly applied ₱30,000 in just-cause dismissals with procedural defects, although the appropriate relief ultimately depends on controlling law and the case’s circumstances.

If the employer cannot prove a just cause, the dismissal may be illegal even if two notices and a hearing were provided. Procedure cannot cure the absence of evidence.

When legal help is urgent

Seek advice promptly if:

A response period is already running;
Preventive suspension is approaching or has exceeded 30 days;
The employer is demanding an immediate resignation, confession, repayment, or waiver;
The questioned records involve large losses, regulated transactions, taxes, public documents, or possible criminal charges;
Evidence may be deleted, overwritten, or taken outside the Philippines;
The employee is a union officer or the incident may involve retaliation, discrimination, or union activity;
The investigator or decision-maker has a direct personal conflict;
A termination letter has been issued;
A company plans to report the matter to police, prosecutors, regulators, customers, or professional bodies; or
The contract, handbook, or CBA grants additional procedural rights.

An employee may seek assistance through DOLE’s Single Entry Approach and, when unresolved, pursue an illegal-dismissal complaint before the proper NLRC Arbitration Branch. The NLRC’s official FAQ states that an illegal-dismissal action generally prescribes in four years from accrual. Related money claims generally have a different prescriptive period, so waiting is unsafe. Consult the current 2025 NLRC Rules of Procedure for filing and procedural requirements.

Frequently asked questions

Can the employee be dismissed immediately after an audit discovers a false record?

Generally, no. Unless the employee validly admits liability under circumstances that still permit a fair and lawful decision, the employer should investigate, issue a detailed first notice, allow at least five calendar days for an explanation, provide a meaningful opportunity to be heard, evaluate the evidence, and issue a written decision.

Must the employer hold a face-to-face hearing?

Not in every case. A meaningful written opportunity may be sufficient. A hearing or conference becomes mandatory when requested by the employee in writing, substantial evidentiary disputes exist, company rules or practice require one, or comparable circumstances make one necessary.

May the employee have a lawyer or union representative?

The employee must be given ample opportunity to defend himself or herself with a representative if desired. The first-notice period is intended, among other things, to allow consultation with or representation by a lawyer or union officer. Company rules and the CBA may provide additional rights.

Can preventive suspension be unpaid?

A properly grounded preventive suspension may generally be imposed for up to 30 days. If it is extended because the investigation remains pending, the employee must be paid wages and benefits during the extension. If the suspension lacked sufficient basis, back pay for the suspension period may be due.

What if the employee refuses to explain?

After valid service and a genuine opportunity to respond, the employer may decide based on the available evidence. Refusal or silence does not relieve the employer of its burden to prove the charge by substantial evidence.

Can an anonymous report start an investigation?

Yes, it may trigger verification. It should not, without corroboration, be treated as proof of fraud or as sufficient basis for dismissal.

Can an employee be liable even if someone else created the false record?

Possibly. Knowing approval, use, submission, assistance, or concealment may support liability. Mere receipt, access, routing, or mechanical processing does not automatically prove knowing participation.

Does repayment erase the offense?

Not necessarily. Repayment may affect the factual or penalty assessment, but it does not automatically undo proven intentional fraud or restore trust. Conversely, an unexplained demand for repayment is not proof that the employee committed fraud.

Do company rules replace Labor Code due process?

No. A handbook, employment contract, or CBA may add protections but cannot remove the minimum statutory requirements. Employers must also apply their own binding procedures and any negotiated grievance or discipline provisions.

This article provides general Philippine legal information, not legal advice for a specific case. Outcomes depend on the evidence, employment documents, workplace rules, collective agreements, and subsequent legal developments. Official sources were checked as of 2 August 2026.