Quick answer

An employer in the Philippines may investigate suspected employee fraud, dishonesty, or falsification of company records, and proven misconduct may justify dismissal. But suspicion, an irregular document, an audit discrepancy, or even the filing of a criminal complaint does not automatically make a dismissal lawful.

For a private-sector employee, the employer must establish a valid substantive ground under Article 297 of the Labor Code and, if dismissal is contemplated, comply with procedural due process. For just-cause termination, Department of Labor and Employment (DOLE) Department Order No. 147-15 requires two written notices and a genuine opportunity to answer the charge. The first notice must identify the specific ground, narrate the material facts in detail, identify applicable company policies, and give the employee at least five calendar days from receipt to prepare a written explanation. After considering the defense and evidence, the employer may issue a second written notice if it determines that termination is justified. (eLibrary)

A formal trial-type hearing is not automatically required in every case. It becomes mandatory when the employee requests one in writing, substantial evidentiary disputes exist, company rules or established practice require one, or similar circumstances justify it. (eLibrary)

This discussion concerns employees covered by the Labor Code. Government employees are generally governed by civil-service and administrative disciplinary rules, which involve a different procedure.

Fraud, dishonesty, and falsified records can be just causes—but proof still matters

Article 297 of the Labor Code permits an employer to terminate employment for, among other grounds, fraud or willful breach of the trust reposed in the employee. DOLE Department Order No. 147-15 provides that fraud or willful breach of trust requires an act, omission, or concealment involving a breach of a legal duty, trust, or confidence justly reposed in the employee, committed against the employer or its representative, and connected with the employee's work. (eLibrary)

Falsifying records may therefore support dismissal when the evidence establishes intentional dishonesty—for example, knowingly altering transaction records, fabricating receipts, manipulating attendance or payroll entries, entering fictitious transactions, falsifying expense documents, or deliberately changing records to obtain or conceal an improper benefit.

But the legal inquiry should not stop at the label "falsification."

The Supreme Court has stressed that fraud and dishonesty require a dishonest act showing a disposition to deceive, defraud, or betray the employer. Fraud is itself a ground under Article 297 and is conceptually distinct from willful breach of trust. (eLibrary)

The Court has also emphasized that serious misconduct, willful disobedience, and fraud ordinarily involve willfulness or wrongful intent. A mistake, misunderstanding, simple negligence, or mere error in judgment should not automatically be converted into fraud. In Citigroup Business Process Solutions Pte. Ltd. v. Corpuz, decided on June 5, 2024, the Supreme Court reiterated that dismissal is the ultimate disciplinary penalty and that fraud or dishonesty requires the necessary deceptive intent. (eLibrary)

That distinction is especially important when an allegedly false record could have resulted from a data-entry error, incorrect instructions, system malfunction, another user's access, shared credentials, clerical mistakes, or an established but improper workplace practice.

The employer bears the burden of proving the charge

In an illegal-dismissal case, it is the employer—not the employee—who must prove that termination was supported by a just or authorized cause. The required evidentiary standard in labor proceedings is substantial evidence, meaning relevant evidence that a reasonable mind might accept as adequate to support a conclusion. (eLibrary)

This does not require proof beyond reasonable doubt. A company does not ordinarily have to wait for a criminal conviction before taking lawful disciplinary action. Employment proceedings and criminal proceedings involve different issues and different standards of proof. (eLibrary)

However, the lower evidentiary standard does not permit dismissal based on speculation.

For example, the mere existence of a falsified document does not necessarily prove that the accused employee falsified it. In one Supreme Court case involving falsified entries in an employee's medical card, the employer failed to establish by substantial evidence that the employee himself made the unauthorized entries. The Court expressly distinguished proof that a document was falsified from proof identifying the person responsible for the falsification. (eLibrary)

That principle is critical in modern workplaces where records can be accessed by several employees or altered through shared systems.

A defensible investigation should begin with evidence preservation, not an assumption of guilt

Before issuing disciplinary charges, management should preserve the relevant evidence and determine what actually happened.

Depending on the suspected scheme, useful records may include:

original receipts, vouchers, invoices, purchase orders, reimbursement claims, time records, payroll entries, inventory records, and accounting documents;
audit trails showing when a record was created, changed, approved, or deleted;
system-access logs and records identifying the credentials used;
emails, work messages, workflow approvals, and other business communications lawfully available to the employer;
CCTV recordings where lawfully collected and relevant;
handwriting or signature samples where authenticity is genuinely disputed;
witness statements from persons with direct knowledge;
the employee's job description and actual duties;
applicable company rules, fraud policies, codes of conduct, disciplinary schedules, and acknowledgment forms;
training records showing what rules or procedures were communicated to the employee; and
records showing whether comparable violations have previously been treated consistently.

Preserve original files whenever possible. Avoid editing, annotating, renaming, overwriting, or repeatedly resaving electronic evidence in ways that may destroy useful metadata. Document who collected important records, when they were collected, and where they came from.

The goal is not merely to accumulate documents supporting the accusation. Investigators should also preserve evidence that may contradict it.

Identify the exact misconduct before issuing the Notice to Explain

A common mistake is to send an employee a memorandum merely saying:

"You committed fraud and dishonesty. Explain within 24 hours."

That is generally inadequate for a dismissal process.

Under DOLE Department Order No. 147-15, the first written notice should contain:

the specific statutory ground or grounds under Article 297 and the relevant company policies, if any;
a detailed narration of the facts and circumstances forming the basis of the charge—a general description is insufficient; and
a directive giving the employee a reasonable period to submit a written explanation.

For this purpose, a reasonable period means at least five calendar days from receipt of the notice so the employee can study the accusation, consult a lawyer or union officer, gather evidence, and decide how to defend against the charge. (eLibrary)

The notice should therefore identify, as concretely as the available evidence permits, matters such as the disputed transaction, record, date, amount, account, document, claimed alteration, employee action, and applicable rule.

If management already knows that dismissal is one possible consequence, the notice should make the charge sufficiently clear for the employee to understand what conduct could lead to termination.

Do not treat a 24-hour or 48-hour explanation period as the normal dismissal standard

Companies sometimes use a standard "48-hour Notice to Explain." That may create a due-process problem when the notice is part of a potential just-cause dismissal.

DOLE's current rule treats five calendar days from receipt as the minimum reasonable period for preparing the explanation in a just-cause termination process. (eLibrary)

An employee may voluntarily answer earlier, but management should not force an employee facing possible dismissal to prepare a meaningful defense within a materially shorter period and then treat the failure to respond within that shortened deadline as a waiver.

Give the employee a real—not predetermined—opportunity to defend against the accusation

Due process is not satisfied merely by collecting a written explanation for the file after management has already decided to dismiss the employee.

The employee must have a meaningful opportunity to controvert the accusation and present supporting evidence. Management should actually consider:

the employee's explanation;
documents submitted in response;
alternative explanations for the disputed records;
claims that another person had system or document access;
evidence of authorization or supervisory instructions;
inconsistencies in witness statements;
explanations for audit discrepancies;
evidence regarding intent;
the employee's actual job responsibilities; and
other circumstances material to whether the charged violation was committed.

The employer's case ultimately stands on its own evidence. A weak explanation from an employee does not relieve the employer of its burden to establish a valid cause for dismissal. (eLibrary)

Is a formal administrative hearing required?

Not always.

Philippine labor law requires ample opportunity to be heard, not necessarily a courtroom-style proceeding. Written explanations and supporting documents may satisfy the requirement where they provide a genuine opportunity to answer the accusation.

A formal hearing or conference becomes mandatory, however, when:

the employee requests one in writing;
substantial evidentiary disputes exist;
the employer's own rules or established practice require one; or
comparable circumstances make a hearing necessary for a fair resolution.

This standard appears both in Supreme Court jurisprudence and DOLE Department Order No. 147-15. (eLibrary)

Fraud and falsification cases frequently involve factual disputes about authorship, authorization, computer access, signatures, document alteration, or intent. When those disputes are substantial, an administrative conference may be necessary even if management initially believed a written exchange would be enough.

The employee may be assisted by a representative if he or she so desires, consistent with the governing rules. (eLibrary)

Follow the company's own disciplinary procedure and the CBA

The Labor Code and DOLE rules provide the statutory minimum. They do not necessarily exhaust the employer's obligations.

A collective bargaining agreement, employment contract, employee handbook, code of discipline, or established company practice may require additional steps—for example:

an investigation committee;
a formal administrative hearing;
specified notice periods;
union representation;
progressive discipline;
an internal appeal; or
approval by designated company officers.

The Supreme Court has recognized that company rules regulating termination procedures can bind the employer. A formal hearing that would not otherwise be universally required may therefore become mandatory because the employer's own rules require it. (eLibrary)

Before disciplining an employee, management should review the version of the policy actually applicable at the time of the alleged offense.

Falsification does not always mean automatic dismissal

Even where some form of record irregularity is established, the employer should determine exactly what offense the evidence proves and what penalty lawfully applies.

Relevant questions include:

Was the false entry intentional?
Did the employee make, direct, approve, or knowingly use it?
Was anybody intended to obtain an improper benefit?
Was the employer prejudiced or exposed to material risk?
Did the employee occupy a position of trust?
Was this a first offense?
What penalty does the company's disciplinary code prescribe?
Are there mitigating or aggravating circumstances?
How has the employer treated comparable violations?
Does the conduct demonstrate that continued employment has become untenable?

In San Miguel Corporation v. NLRC, the Supreme Court examined the employer's own disciplinary rules, which distinguished different forms of falsification and imposed different penalties depending on the circumstances. The case illustrates why an employer should not simply label every falsification case as the most serious possible offense without applying the governing rule to the proven facts. (eLibrary)

Loss of trust and confidence requires additional care

An employer may also invoke loss of trust and confidence where legally appropriate, but that doctrine should not be used as a catch-all whenever management becomes suspicious of an employee.

For dismissal specifically on the basis of willful breach of trust or loss of confidence, jurisprudence generally looks at whether the employee occupies a position of trust and confidence—such as managerial personnel or employees who regularly handle substantial amounts of the employer's money or property—and whether there is a real, willful act justifying the loss of trust. (eLibrary)

The loss of confidence must be genuine, supported by established facts, and not simulated, arbitrary, or asserted as an afterthought. (eLibrary)

By contrast, the Supreme Court has clarified that fraud itself is a distinct ground under Article 297. Thus, the analysis should identify whether the evidence actually establishes fraud, willful breach of trust, serious misconduct, another company offense, or some combination supported by the facts—not simply invoke "loss of confidence" because it sounds broad. (eLibrary)

Preventive suspension during a fraud investigation is not automatic

An employer does not have an unrestricted right to place every accused employee on unpaid preventive suspension.

Preventive suspension is permissible when the employee's continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. It is preventive rather than punitive: its purpose is to protect the workplace while the investigation is pending. (eLibrary)

In a fraud investigation, this may be relevant where an employee retains access to cash, financial systems, confidential records, inventory, evidence, or company property and there is a genuine serious and imminent risk to that property.

The ordinary maximum period of preventive suspension is 30 days. After that, the employer must reinstate the employee to the former or a substantially equivalent position, or it may extend the suspension while paying the wages and other benefits due during the extension. An unjustifiably prolonged preventive suspension may lead to a finding of constructive dismissal. (eLibrary)

Employers should therefore avoid using preventive suspension merely because an allegation is embarrassing, serious-sounding, or under investigation.

Protect privacy when investigating electronic records

An employer's legitimate interest in protecting its business does not eliminate employees' data-privacy rights.

Where an investigation involves computer activity, email, CCTV, access logs, or other personal data, the Data Privacy Act requires lawful processing and compliance with principles such as transparency, legitimate purpose, and proportionality. (National Privacy Commission)

The National Privacy Commission has specifically recognized that employers may have legitimate interests in workplace monitoring and disciplinary investigations, while emphasizing that monitoring should be necessary, proportionate, properly governed, and balanced against employee rights. Clear monitoring policies and appropriate safeguards are important. (National Privacy Commission)

This matters particularly where investigators are considering intrusive measures such as secret monitoring, access to personal communications, recording, or collection of information unrelated to the suspected misconduct.

The safer approach is to collect only information reasonably relevant to the investigation, restrict access to authorized persons, preserve confidentiality, and follow the company's privacy and information-security policies.

The second notice must come after genuine consideration of the case

If, after reviewing the employee's defense and all relevant evidence, management concludes that dismissal is justified, the employer must issue the second written notice.

Under Department Order No. 147-15, the termination notice should indicate that:

all circumstances involving the charge have been considered; and
the grounds have been established to justify termination.

The notices should be served personally or at the employee's last known address as prescribed by the rule. (eLibrary)

The final decision should correspond to the conduct the employee was actually given an opportunity to answer. An employer creates significant due-process risk if the final notice dismisses the employee for a materially different accusation that was never included in the charge.

A practical investigation sequence

For most suspected fraud or falsification cases, a defensible process looks like this:

Secure the records. Preserve originals, electronic logs, audit trails, CCTV, transaction records, and other potentially relevant evidence.
Control immediate risks. Restrict access where reasonably necessary. Use preventive suspension only when the legal serious-and-imminent-threat standard is met.
Conduct preliminary fact-finding. Determine what happened, who had access, what rules apply, and whether there is a reasonable factual basis for formal charges.
Identify the precise offense. Distinguish intentional fraud or falsification from mistake, negligence, unauthorized procedure, or other misconduct.
Issue a detailed first written notice. State the material facts, applicable Article 297 ground, relevant company rules, and possible disciplinary consequence.
Give at least five calendar days from receipt to explain.
Receive and assess the defense. Consider contrary evidence instead of merely looking for confirmation of the original suspicion.
Hold a hearing or conference when legally required or factually appropriate.
Reach a decision based on substantial evidence. Decide separately whether the offense occurred and what penalty is warranted.
Issue the appropriate written decision. If dismissal is imposed, comply with the second-notice requirement and clearly state the established basis.

Evidence both sides should preserve

Employers

Preserve the investigation file, including the original complaint or audit finding, documents relied upon, system logs, witness statements, correspondence, notices, proof of receipt, employee explanation, hearing records, company policies, and the evidence showing how management reached its conclusion.

Employees

An employee accused of fraud or falsification should preserve copies of the Notice to Explain, relevant records, emails, instructions from supervisors, system-access information, approvals, receipts, messages, applicable policies, previous versions of disputed documents, and proof showing that other persons had access or authority.

If important company records are needed for the defense, the employee should identify them promptly and request access or production in writing where appropriate.

Neither side should alter or destroy evidence once a dispute is reasonably anticipated.

Common mistakes that create legal problems

Employers commonly weaken otherwise legitimate investigations by:

issuing only a vague accusation of "fraud," "dishonesty," or "loss of confidence";
requiring an explanation in only 24 or 48 hours when dismissal is contemplated;
failing to identify which transaction or document was allegedly falsified;
assuming the person whose name appears on a record necessarily made the false entry;
ignoring evidence showing shared access or another possible author;
treating negligence or error as intentional fraud without proof of wrongful intent;
deciding on dismissal before receiving the employee's explanation;
refusing a written request for a hearing despite substantial factual disputes;
ignoring hearing procedures contained in the CBA or company rules;
placing the employee on preventive suspension without the required serious and imminent threat;
allowing preventive suspension to exceed 30 days without reinstatement or paid extension;
conducting disproportionate or unlawful surveillance;
relying solely on an accusation or criminal complaint rather than independent evidence; or
imposing dismissal automatically without checking the applicable disciplinary policy and circumstances.

Employees, on the other hand, commonly hurt their position by ignoring the Notice to Explain, answering only verbally, deleting messages or files, altering disputed records after the investigation begins, making admissions without explaining relevant circumstances, or failing to request a hearing in writing when important factual disputes require one.

What happens if the employer proves the fraud but violates procedural due process?

Substantive and procedural due process are separate.

If there was genuinely a just cause for dismissal but the employer failed to observe the required termination procedure, the dismissal is not necessarily converted into an illegal dismissal solely because of that procedural defect. Under prevailing Supreme Court jurisprudence, however, the employer may be ordered to pay nominal damages, commonly ₱30,000 in just-cause dismissals, for violation of the employee's statutory right to procedural due process. (eLibrary)

That rule should not be misunderstood as permission to disregard due process. If the employer also fails to prove a valid substantive ground, the consequences can be significantly greater because the dismissal itself may be declared illegal.

When legal help is urgent

Employers should obtain labor-law advice before taking final action when the alleged fraud involves substantial losses, senior or fiduciary employees, multiple participants, possible criminal charges, forensic examination of computers, disputed signatures, whistleblower allegations, unionized employees, privacy-sensitive monitoring, or a preventive suspension approaching 30 days.

Employees should seek advice promptly when they receive a Notice to Explain involving possible dismissal, especially where the notice gives less than five calendar days, the accusation is vague, records necessary for the defense are being withheld, preventive suspension is imposed indefinitely, management appears to have predetermined dismissal, or the accusation may also expose the employee to criminal liability.

If termination develops into a labor dispute, Department Order No. 147-15 provides for mandatory conciliation-mediation of termination disputes under the Single Entry Approach. For organized establishments, applicable CBA grievance procedures must also be considered. (eLibrary)

Frequently asked questions

Can an employer investigate an employee before issuing a Notice to Explain?

Yes. Preliminary fact-finding may be necessary to determine whether there is a reasonable basis for formal disciplinary charges. But once dismissal is being pursued for a just cause, the employee must receive the required written charge and meaningful opportunity to defend against it before termination.

Does the company have to prove fraud beyond reasonable doubt?

No. The employment case generally turns on substantial evidence, not the criminal-law standard of proof beyond reasonable doubt. The employer must nevertheless present real evidence sufficient to establish the charged misconduct. (eLibrary)

Is a criminal conviction necessary before an employee can be dismissed?

No. A disciplinary case may proceed independently, and a later acquittal does not automatically invalidate an employment decision that was otherwise supported by substantial evidence. (eLibrary)

Is every false entry automatically fraud?

No. Fraud ordinarily requires intentional dishonesty or wrongful intent. The employer should distinguish a deliberate falsification from an error, negligence, misunderstanding, unauthorized procedure, or conduct attributable to another person. (eLibrary)

Must the employer attach every piece of evidence to the Notice to Explain?

DOLE's rule expressly requires the specific ground and a detailed narration of the facts; it does not state that every document in the investigation file must invariably be attached. The employee must nevertheless receive enough information to understand and meaningfully answer the charge. Where material evidence is disputed or necessary to the defense, withholding it may create fairness and evidentiary issues.

Is five days five working days?

The DOLE rule specifies five calendar days from receipt, not five working days. (eLibrary)

Can an employee demand a hearing?

The employee may request a formal hearing or conference in writing. Once properly requested, or where substantial evidentiary disputes exist, company rules require it, or similar circumstances justify it, a formal hearing or conference becomes mandatory. (eLibrary)

Can the employer suspend the employee while investigating?

Only preventive suspension meeting the applicable legal standard should be imposed: continued employment must pose a serious and imminent threat to life or property. The normal maximum is 30 days; beyond that, reinstatement or a paid extension is required. (eLibrary)

Can falsification justify dismissal even for a first offense?

Possibly, particularly where deliberate fraud is serious and the facts satisfy a just cause under Article 297. But the applicable company rules, the employee's involvement, wrongful intent, gravity, position, surrounding circumstances, and prescribed penalty should all be examined. A finding that a record is inaccurate does not by itself resolve those issues.

Official sources

General-information disclaimer

This article provides general information on Philippine private-sector labor law and is not legal advice for any particular investigation or employment dispute. The correct procedure and outcome may depend on the employee's duties, the evidence, applicable company rules, employment contract, collective bargaining agreement, privacy policies, and other case-specific circumstances. Government employment is subject to different civil-service rules.

Law and official sources checked: August 26, 2026.