Quick answer

An employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. For a lawful termination in the Philippine private sector, the employer must establish a just cause through substantial evidence and observe procedural due process.

Ordinarily, this means:

Preserve and examine the records without prejudging the employee.
Give the employee a detailed written notice of the charge.
Allow at least five calendar days from receipt to prepare a written explanation.
Provide a meaningful opportunity to answer, present evidence, and address material disputes.
Impartially evaluate both sides.
Issue a written decision stating the proven facts and applicable ground or rule.

Fraud or falsification can support dismissal when it was intentional, work-related, adequately proven, and sufficiently serious under the Labor Code or a valid company rule. An honest mistake, an unsupported accusation, or a discrepancy that cannot fairly be attributed to the employee is not automatically fraud.

These rules generally concern private-sector employment. Government personnel are governed by civil-service and administrative-disciplinary rules, while collective bargaining agreements, employment contracts, and company policies may provide additional protections.

What must be proven

Article 297 of the Labor Code permits termination for, among other grounds:

Serious misconduct;
Fraud or willful breach of the trust placed in the employee;
Gross and habitual neglect of duties;
Commission of a crime or offense against the employer, an immediate family member of the employer, or the employer’s duly authorized representative; and
Causes analogous to those listed by law.

Falsifying a time record, reimbursement, sales report, inventory entry, medical certificate, leave form, application document, official receipt, voucher, payroll record, or electronic transaction log may fall under one or more of these grounds. The label placed on the act is not decisive. The employer must prove the particular ground actually charged.

For fraud or willful breach of trust, the evidence should establish an intentional, knowing, and purposeful act without a justifiable excuse—not mere carelessness, misunderstanding, or error in judgment. The act must be connected with the employee’s work and must demonstrate unfitness to remain in the position.

Loss of trust and confidence is not a catch-all ground. It ordinarily applies to:

Managerial employees; or
Rank-and-file employees entrusted with significant money, property, records, access, or other fiduciary responsibilities, such as cashiers, auditors, or property custodians.

The employer must still identify a real act that justifies the loss of trust. It cannot rely on rank, access, or a bare assertion that management has “lost confidence.”

The required level of proof

The employer carries the burden of proving a valid cause for dismissal. The applicable standard in a labor case is substantial evidence: relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

Proof beyond reasonable doubt is not required for an employment decision. Nevertheless, substantial evidence is more than rumor, guesswork, or an unverified accusation. The evidence must reasonably connect the employee to the act.

Useful evidence may include:

Original or reliably preserved business records;
Audit trails, version histories, access logs, and system-generated timestamps;
Authenticated emails, messages, and transaction records;
CCTV footage preserved with its date, source, and chain of custody;
Written policies and proof that the employee received or knew them;
Specimen signatures or verified source documents;
Witness statements based on personal knowledge;
Reconciliation reports and a clear explanation of discrepancies;
The employee’s admissions, explanations, or contemporaneous communications; and
Evidence showing who had access, authority, motive, or opportunity to create or change the record.

A discrepancy by itself may show that something is wrong, but not necessarily who caused it or whether the act was intentional. Shared accounts, editable templates, weak access controls, missing originals, system errors, delegated data entry, and unclear approval procedures must be investigated.

A fair investigation, step by step

1. Secure evidence and stop further risk

Preserve potentially relevant material as soon as a credible concern arises. Suspend routine deletion, overwriting, or auto-purge processes affecting the records under review.

Keep:

Original paper documents and properly documented copies;
Native electronic files and available metadata;
Relevant access and security logs;
Backups and version histories;
CCTV recordings before they are overwritten;
Approval chains and segregation-of-duties records;
Applicable policies in effect on the incident date; and
Notes showing who collected, copied, transferred, or examined each important item.

Do not alter a disputed document merely to “clean it up” for presentation. Work from copies and retain the original or authoritative system record.

Access to personal information should be limited to people with a legitimate role in the inquiry. The Data Privacy Act does not prohibit legitimate workplace investigations, but personal data must still be processed for a lawful purpose and handled proportionately and securely.

2. Define the allegation before interviewing the employee

Identify the transaction, document, date, amount, system entry, statement, or omission in question. Determine:

What information is allegedly false;
Who created, changed, submitted, approved, or benefited from it;
What rule, duty, or instruction applied;
Whether the employee had access and responsibility;
Whether the discrepancy may have an innocent or technical explanation; and
What employment ground could apply if the facts are proven.

An investigation should test alternative explanations. It should not begin with a predetermined decision to dismiss.

3. Issue a detailed notice to explain

The first written notice should enable the employee to answer intelligently. It should state:

The specific acts or omissions alleged;
The relevant dates, transactions, documents, or records;
The facts linking the employee to the alleged falsification or fraud;
The company rule, policy, or instruction allegedly violated;
The applicable just cause under the Labor Code, if dismissal is being considered;
That dismissal or another disciplinary penalty may result; and
The deadline and manner for submitting an explanation.

A notice that merely says “fraud,” “dishonesty,” “falsification,” or “loss of trust” without the supporting facts is ordinarily inadequate. The employer should not later dismiss the employee for a materially different accusation that was never included in the notice.

The employee should receive at least five calendar days from receipt to study the accusation, consult a union representative or lawyer, gather records, and prepare a response. A shorter period may deny a reasonable opportunity to defend oneself.

Keep proof of when and how the notice was served.

4. Give a meaningful opportunity to respond

The employee should be allowed to:

Submit a written explanation and supporting documents;
Identify witnesses or records that may disprove the charge;
Explain system access, workflows, approvals, or delegated tasks;
Challenge the authenticity, completeness, or interpretation of evidence;
Correct factual errors; and
Request a reasonable opportunity to inspect or address material evidence, subject to legitimate confidentiality and security limits.

Under DOLE rules, an administrative hearing or conference becomes particularly important when the employee requests one in writing, substantial evidentiary disputes exist, or company rules or established practice require it. Even where a trial-type hearing is unnecessary, the employee must receive a genuine opportunity to be heard.

If a conference is held, document the attendees, issues discussed, evidence presented, requests made, and material responses. The employee may be assisted by a representative or counsel of choice. A private employer’s internal investigation is not a criminal trial, so courtroom procedures and cross-examination do not automatically apply.

Failure to submit an explanation after proper notice does not establish fraud by itself. The employer must still decide the charge from adequate evidence. A refusal or absence should be documented, and any timely, reasonable explanation for it should be considered.

5. Investigate both incriminating and exculpatory facts

Before deciding, verify:

Whether the document or record is authentic;
Whether the employee personally made or authorized the disputed entry;
Whether credentials were shared, compromised, or used by another person;
Whether the system permits backdating or post-approval changes;
Whether the employee followed an established practice approved by a supervisor;
Whether inconsistent instructions contributed to the event;
Whether the supposed falsehood is material;
Whether intent can reasonably be inferred from the surrounding facts;
Whether similarly situated employees were treated consistently; and
Whether the proposed penalty complies with the company code, CBA, and prior practice.

Interview witnesses separately where appropriate and obtain statements based on personal knowledge. Hearsay may sometimes be considered in administrative settings, but an important accusation should not rest solely on layered rumor when direct evidence or a firsthand statement can reasonably be obtained.

6. Make findings charge by charge

The decision-maker should determine separately:

Which factual allegations were proven;
Which were not proven;
What evidence supports each finding;
Whether the employee acted intentionally;
Which rule and statutory ground apply;
Whether the offense is sufficiently serious; and
Whether dismissal is proportionate under the facts, policy, and applicable law.

Long service or a clean record does not automatically excuse deliberate fraud, particularly in a position requiring trust. Conversely, the seriousness of the accusation does not cure weak evidence or defective procedure.

7. Issue a written decision

If discipline is imposed, the decision notice should state:

The charge evaluated;
The material facts established;
That the employee’s explanation and relevant evidence were considered;
The rule or legal ground violated;
The penalty;
The effectivity date; and
Any internal appeal or review procedure.

If dismissal is chosen, the decision must rest on the charges for which the employee was given an opportunity to defend. Management should not add a new ground only in the final notice.

If the charge is not sufficiently established, the employee should be cleared or given only the penalty justified by the proven conduct and governing rules.

Preventive suspension is limited

Preventive suspension is not itself a finding of guilt or a disciplinary penalty. It may be used while the investigation is pending only when the employee’s continued presence presents a serious and imminent threat to life or property, including a demonstrated risk to vital records or evidence.

In a records-falsification inquiry, possible access to documents, systems, witnesses, funds, or assets may support preventive measures, but the employer should document the actual risk. The accusation alone does not automatically justify suspension.

Preventive suspension is generally limited to 30 days. If the investigation is not completed within that period, the employer must ordinarily reinstate the employee to the former position or to the payroll. An extension beyond 30 days must not leave the employee without the salaries and benefits accruing during the extended period. A preventive suspension imposed without sufficient basis can result in liability for the employee’s lost wages.

Less restrictive safeguards may sometimes be adequate, such as:

Temporarily revoking approval or system privileges;
Preserving accounts and access logs;
Reassigning sensitive duties;
Requiring dual authorization;
Restricting access to specified files or premises; or
Placing relevant records under independent custody.

These measures must not become a disguised demotion, punishment, or constructive dismissal.

Internal discipline and criminal proceedings are separate

An employer does not have to obtain a criminal conviction—or even file a criminal complaint—before imposing employment discipline supported by substantial evidence. A later acquittal or dismissal of a criminal case does not automatically determine the labor case because the standards and issues differ.

The reverse is also true: an internal finding does not establish criminal guilt. Criminal liability for falsification, estafa, theft, cybercrime, or another offense must be evaluated under the applicable penal law and criminal-procedure standards.

If a criminal complaint is contemplated, avoid coercing a confession, threatening an employee merely to force a resignation, or describing an accusation as proven guilt before the evidence is evaluated. Preserve originals and obtain prompt legal advice on authentication, forensic examination, affidavits, and coordination with law enforcement.

Important exceptions and special situations

Probationary employees

A probationary employee may be dismissed for a just cause or for failure to meet reasonable standards made known at the time of engagement. If the real accusation is fraud or falsification, the employer should not disguise it as mere failure to qualify to avoid the due-process requirements for a just-cause dismissal.

Unionized workplaces

The CBA may require additional notice, union representation, grievance proceedings, a disciplinary panel, or arbitration. Those protections must be observed together with statutory minimums.

Fixed-term, project, and contractor arrangements

The worker’s legal status and the identity of the true employer may affect the remedy and proper respondent. Calling someone a consultant or contractor does not control if the actual relationship is employment.

Government employees

Administrative cases against public officers and employees follow civil-service statutes, the applicable agency rules, and constitutional administrative due process. The private-sector procedure described here should not be treated as a substitute for those rules.

Whistleblowers, complainants, and witnesses

An investigation must not be used as retaliation for a protected complaint, union activity, testimony, or lawful assertion of employment rights. The employer should separate the underlying fraud inquiry from any dispute involving the employee’s protected conduct.

Practical checklist for employers

Before dismissing an employee, confirm that:

The investigator preserved reliable originals and electronic records.
The evidence identifies the employee, not merely an irregular transaction.
Intent has been evaluated rather than assumed.
The charge is work-related and matches a lawful ground.
A trust-based charge fits the employee’s actual position and duties.
The notice gives detailed facts, rules, and possible consequences.
At least five calendar days from receipt were allowed for an explanation.
The employee received a meaningful chance to answer and present evidence.
Any requested or necessary conference was properly handled.
Exculpatory evidence and alternative explanations were assessed.
The decision addresses only charges properly notified.
Preventive suspension, if any, had a documented basis and stayed within its legal limits.
The CBA, contract, code of discipline, and consistent company practice were followed.
The penalty is supported by the proven facts.
The complete investigation file and proofs of service are retained.

Practical checklist for an accused employee

If you receive a notice to explain:

Record the date and time you received it.
Read each factual allegation and the cited company rule.
Ask in writing for clarification if the notice is vague.
Request relevant records needed to answer, identifying them specifically.
Preserve emails, messages, schedules, approvals, log-in alerts, and copies of the disputed records lawfully in your possession.
Do not delete files, alter evidence, coordinate false accounts, or pressure witnesses.
Explain the workflow and identify everyone who had access or authority.
State clearly whether you deny creating, changing, approving, or knowingly submitting the record.
Attach supporting documents and identify witnesses with personal knowledge.
Request a conference in writing if facts or evidence are materially disputed.
Consult your union representative or a labor lawyer promptly if dismissal or criminal charges are possible.
Keep copies of every notice, response, attachment, proof of submission, suspension order, and decision.

Do not resign or sign a quitclaim merely because management says dismissal is inevitable. Ask for time to read the document and obtain advice. A resignation must be voluntary; however, its validity will depend on the actual circumstances and evidence.

Common mistakes

Mistakes by employers

Treating an audit variance as automatic proof of fraud;
Issuing a vague notice or allowing only 24 or 48 hours to answer;
Deciding the penalty before receiving the explanation;
Charging negligence but dismissing for fraud or loss of trust;
Relying entirely on anonymous or hearsay accusations;
Ignoring shared passwords, weak controls, or other possible actors;
Using preventive suspension as an automatic punishment;
Exceeding 30 days of unpaid preventive suspension;
Refusing to consider documents that contradict the accusation;
Failing to prove that the employee held a position of trust;
Publicly announcing guilt before the investigation ends; or
Assuming that filing a criminal complaint proves a valid dismissal.

Mistakes by employees

Ignoring the notice because the accusation seems obviously false;
Giving a rushed oral denial without a documented written response;
Altering, deleting, or taking confidential records without authority;
Relying on a coworker to submit the response;
Signing an admission, resignation, or settlement without reading it;
Missing an internal grievance or appeal deadline; or
Assuming that the absence of a criminal case makes dismissal impossible.

When legal help is urgent

Seek prompt advice from a Philippine labor lawyer, union representative, or appropriate government office when:

A dismissal notice has already been issued;
The response period is about to expire;
Preventive suspension is approaching or has exceeded 30 days;
The employer is demanding an immediate resignation or confession;
Police, prosecutors, the NBI, or another enforcement body are involved;
A search, seizure, forensic examination, or recovery of personal devices is proposed;
The disputed records contain banking, health, biometric, or other sensitive personal data;
The allegation involves a large loss, multiple employees, senior officers, or regulatory reporting;
Retaliation, discrimination, union activity, or whistleblowing may be involved; or
The employee needs to contest an alleged illegal dismissal.

An employee may seek conciliation through DOLE’s Single Entry Approach and, if unresolved and within the proper jurisdiction, file a complaint before the appropriate NLRC Regional Arbitration Branch. An illegal-dismissal action generally prescribes four years from the accrual of the cause of action, but related money claims or contractual grievance procedures may have different and sometimes much shorter periods. Acting promptly is safer.

Consequences of getting the process wrong

If the employer fails to prove a just cause, the dismissal may be declared illegal, with remedies that can include reinstatement and full backwages, or separation pay in lieu of reinstatement when legally appropriate. Other monetary relief depends on the pleadings and proven circumstances.

If a valid just cause is proven but the employer failed to observe the required statutory procedure, the dismissal may remain valid, but the employer may be ordered to pay nominal damages. Under Agabon v. NLRC, the established amount for a just-cause dismissal made without proper procedural due process is generally ₱30,000.

That amount should not be treated as a license to skip the investigation. Procedural defects can also weaken the evidence, create disputes about what was charged, violate a CBA or contract, and expose the company to additional claims where bad faith or other actionable conduct is proven.

Frequently asked questions

Is falsifying any company record automatically grounds for dismissal?

No. The employer must prove the employee’s responsibility, intent, work connection, applicable rule or statutory ground, and the seriousness of the offense. The result depends on the record falsified, the employee’s duties, the surrounding circumstances, and the evidence.

Must the employee be shown every piece of evidence?

Due process requires enough factual detail and a meaningful chance to defend against the charge. It does not necessarily require criminal-case discovery or unrestricted access to confidential data. Material evidence should be disclosed or described sufficiently for a fair response, with appropriate redactions or safeguards when necessary.

Is a face-to-face hearing always required?

Not in every case. The essential requirement is a real opportunity to be heard. A hearing or conference should be provided when the employee requests it in writing, material evidentiary disputes require clarification, or the CBA, company policy, or established practice requires one.

Can the employer use electronic logs or CCTV?

Yes, if they are relevant and reliably preserved. The employer should establish the source, date, integrity, access controls, and connection to the employee. Collection and use should also comply with applicable privacy and workplace-notice requirements.

Can silence be treated as an admission?

Failure to answer after valid notice permits the employer to proceed on the available evidence, but silence alone does not prove fraud. The employer retains the burden of establishing a lawful ground through substantial evidence.

Can an employee be suspended immediately?

Only when preventive suspension has a proper protective basis, such as a serious and imminent threat to life or property or a demonstrated risk to vital evidence. It is not automatic whenever fraud is alleged and generally may not exceed 30 days without the required reinstatement or pay consequences.

Must the employer wait for a criminal case?

No. Employment liability may be decided on substantial evidence independently of criminal proceedings. A criminal conviction requires a different and higher standard of proof.

Is separation pay automatically due after dismissal for fraud?

Generally, statutory separation pay is associated with authorized causes rather than an employee’s proven just-cause dismissal. Any entitlement may nevertheless depend on a CBA, contract, established benefit, or a specific judicial determination.

Official legal sources

This article provides general legal information, not advice for a particular investigation or case. Outcomes depend on the evidence, employment status, governing policies, contractual protections, and procedural history. Official sources and current rules were checked as of August 28, 2026.