Quick answer

An employer may investigate suspected employee fraud or falsified records, preserve evidence, restrict access, and—when strictly necessary—place the employee on preventive suspension. But dismissal is lawful only if the employer proves a just cause under Article 297 of the Labor Code and follows procedural due process.

For a possible dismissal, the employer should:

Conduct an impartial, documented fact-finding investigation.
Give the employee a written notice specifying the acts, dates, records, and applicable rule or legal ground.
Allow at least five calendar days from receipt of the notice for a written explanation and supporting evidence.
Hold a conference or hearing when the employee requests one in writing, material facts are genuinely disputed, company rules require it, or similar circumstances make it necessary.
Consider the entire record—including the employee’s explanation—before deciding.
Issue a separate written decision stating the established facts and grounds for any penalty.

Suspicion, an audit discrepancy, or a general accusation of “dishonesty” is not enough. The employer bears the burden of supporting dismissal with substantial evidence. Conversely, an internal case does not require proof beyond reasonable doubt or a prior criminal conviction.

What conduct may justify dismissal?

Article 297 of the Labor Code recognizes several just causes that may apply to fraud or falsified workplace records, particularly:

Fraud or willful breach of the trust placed in the employee;
Serious misconduct;
Willful disobedience of a lawful, reasonable, and work-related order;
Gross and habitual neglect, when the established facts satisfy both requirements; or
A cause analogous to those expressly listed by law.

The correct ground depends on what the evidence actually proves. Employers should not simply list every possible ground in the notice or decision.

Falsification may involve time records, reimbursement claims, sales documents, receipts, inventory records, payroll entries, medical certificates, customer information, accounting documents, production reports, or electronic approvals. But an inaccurate record is not automatically fraudulent. The investigation must distinguish intentional deception from clerical error, misunderstanding, defective systems, inadequate training, negligence, or an unauthorized change made by another person.

Fraud or willful breach of trust

A breach of trust must be willful—done intentionally, knowingly, and purposely, without a justifiable excuse. An ordinary, careless, or inadvertent breach is not enough. The Supreme Court applied this distinction in San Miguel Corporation v. National Labor Relations Commission.

Loss of trust and confidence ordinarily applies to:

Managerial employees who exercise substantial authority; or
Employees routinely entrusted with the employer’s money or property, such as cashiers, auditors, property custodians, and similarly situated personnel.

The employer must establish an actual, work-related, and willful breach through substantial evidence. Loss of confidence cannot be simulated, asserted as an afterthought, or used to conceal an improper reason for dismissal. The Supreme Court summarizes these requirements in Mabeza v. National Labor Relations Commission.

Serious misconduct

Misconduct must be grave, work-related, willful, and incompatible with the employee’s continued employment. A trivial violation or mere error of judgment ordinarily does not qualify. Depending on the circumstances, deliberate falsification of official work records may constitute serious misconduct or fraud. For example, the Supreme Court has recognized falsification of time cards as serious misconduct and dishonesty in Felix v. National Labor Relations Commission.

That does not create an automatic-dismissal rule for every incorrect time entry. Intent, participation, authenticity of the record, materiality, company policy, and the employee’s explanation still matter.

The required investigation and notice process

1. Secure records without deciding guilt in advance

The employer should promptly preserve potentially relevant material, such as:

Original paper records and properly identified copies;
System audit trails, access logs, timestamps, and approval histories;
Relevant emails, messages, transaction records, and CCTV footage;
Written policies, job descriptions, delegation records, and authorization limits;
Audit findings, reconciliation reports, and source data;
Witness statements based on personal knowledge; and
Records showing who created, changed, reviewed, approved, or had access to the disputed entry.

Preserve metadata and document the source, collector, date, and manner of obtaining electronic evidence. Do not rely solely on an unexplained spreadsheet, cropped screenshot, unsigned summary, or anonymous accusation when the underlying records can reasonably be obtained.

Evidence collection should remain relevant and proportionate. Access to personal information should be limited to authorized people and handled consistently with the Data Privacy Act, legitimate workplace purposes, and the organization’s privacy and security policies.

2. Conduct neutral fact-finding

A preliminary investigation may determine whether there is a genuine case to answer. Investigators should test both incriminating and exculpatory possibilities, including:

Whether the employee actually made or authorized the entry;
Whether credentials or devices were shared;
Whether the system permits later editing or backdating;
Whether supervisors instructed or tolerated the practice;
Whether the disputed record produced or attempted to produce a benefit or concealment;
Whether similarly situated employees were treated consistently; and
Whether the allegation could be retaliatory or discriminatory.

Whenever practical, the investigator should not be the person who made the accusation or the final decision-maker. A conflict of interest should be disclosed and managed.

3. Serve a specific first written notice

The notice to explain should not merely say “fraud,” “dishonesty,” or “falsification.” It should identify, as specifically as available:

The particular acts or omissions charged;
The dates, transactions, documents, or system entries involved;
The employee’s alleged role;
The company rules and possible Labor Code ground implicated;
The material evidence supporting the charge or a fair description of it;
The possible disciplinary consequence, including dismissal if applicable;
Where and how the employee may submit an explanation and evidence; and
The response deadline.

The notice should be served in a manner that permits proof of receipt. If personal service is refused or impracticable, the employer should document the attempts and use an authorized, reliable alternative consistent with company rules and applicable law.

A notice that is too vague to permit a meaningful defense does not satisfy due process. The requirements for a sufficiently detailed first notice and a separate decision notice are explained in King of Kings Transport, Inc. v. Mamac.

4. Give at least five calendar days to answer

Under DOLE Department Order No. 147-15, a reasonable opportunity to respond means at least five calendar days from receipt of the first notice. This period allows the employee to study the accusation, consult a union officer or lawyer, gather information, and prepare defenses.

The deadline should be extended when fairness reasonably requires it—for example, when records were produced late, the allegation is unusually complex, the employee has a documented inability to respond, or the applicable collective bargaining agreement or company policy provides a longer period.

An employee should answer each material allegation, identify disputed documents, explain relevant systems or instructions, name witnesses, and attach available supporting records. If more time or access to identified records is necessary, the employee should request it promptly and in writing.

Silence does not automatically prove fraud. If the employee fails or refuses to respond despite valid service and a meaningful opportunity, however, the employer may ordinarily decide the case using the available evidence.

5. Hold a hearing when required

A courtroom-style trial is not required in every workplace investigation. A meaningful written opportunity to answer may satisfy due process.

A conference or hearing becomes necessary when:

The employee requests it in writing;
Substantial evidentiary disputes exist;
A company rule, established practice, employment agreement, or collective bargaining agreement requires it; or
Comparable circumstances make a conference necessary for a fair evaluation.

This rule is stated in Perez v. Philippine Telegraph and Telephone Company.

At the conference, the employee should be allowed to explain the defense, present relevant evidence, identify material errors, and obtain the assistance allowed by law, policy, or the collective bargaining agreement. The employer should keep accurate minutes or another reliable record and allow the employee to note material corrections.

6. Evaluate the evidence under the proper standard

The standard in an employment case is substantial evidence: relevant evidence that a reasonable mind might accept as adequate to support a conclusion. It is lower than proof beyond reasonable doubt, but it still requires an evidence-based finding rather than suspicion, rumor, or an unsupported audit conclusion.

The decision-maker should assess:

Authenticity and reliability of documents;
Whether records are complete and placed in context;
Witnesses’ personal knowledge, consistency, and possible bias;
System access and the possibility of alteration by others;
The employee’s authority, duties, and position of trust;
Evidence of intent, concealment, benefit, or repetition;
Explanations consistent with error or negligence rather than fraud;
Comparable disciplinary cases;
The gravity of the proven conduct; and
Any relevant mitigating or aggravating circumstances under policy or agreement.

An acquittal or absence of a criminal case does not automatically defeat an administrative employment finding because the proceedings use different standards. Likewise, filing a criminal complaint does not relieve the employer of its duty to conduct a fair workplace process.

7. Issue a separate written decision

After considering the response and all material evidence, the employer should issue a second written notice. It should state:

Which allegations were established and which were not;
The material evidence relied upon;
Why the employee’s significant defenses were accepted or rejected;
The company rule and legal ground applied;
The penalty and its effective date; and
Any internal appeal or grievance process available.

The decision should reflect an actual evaluation, not a conclusion prepared before the employee was heard. If the evidence does not establish the charge, the employer should close the case and correct or securely retain the investigation record according to lawful retention policies.

Preventive suspension is limited

Preventive suspension is not a disciplinary penalty. It is a temporary protective measure while an alleged violation is investigated.

It may be imposed only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. A generic concern that the employee might interfere with an investigation is not, by itself, a substitute for establishing the required threat. In a records-falsification case, the employer should first consider less restrictive controls such as suspending particular system permissions, changing approval authority, preserving logs, reassigning duties, or requiring supervised access.

The initial preventive suspension may not exceed 30 days. After that, the employer must reinstate the employee to the former or a substantially equivalent position, or may extend the suspension only while paying the wages and benefits due during the extension. The employee need not refund extension pay even if later dismissed. These limits are set out in the implementing rules quoted by the Supreme Court in Maula v. Ximex Delivery Express, Inc..

If preventive suspension had no sufficient basis, salary liability may arise for the suspension period. Employers should therefore state and document the concrete threat, start date, and expected duration, and review the measure promptly.

Choosing a proportionate outcome

Dismissal is the most severe employment penalty. Even where wrongdoing occurred, the employer should determine whether the proven facts meet the invoked just cause and warrant termination under the applicable policy, collective bargaining agreement, and jurisprudence.

Relevant considerations may include the employee’s position, level of trust, intent, amount or risk involved, concealment, repetition, actual or potential harm, prior record, treatment of comparable cases, and mitigating circumstances. Length of service is not an automatic defense and, in a position of trust, may sometimes make a deliberate breach more serious.

Possible outcomes include dismissal, a lesser lawful disciplinary penalty, additional controls or training, restitution arrangements that are freely agreed upon, or closure of the case. The employer should not force a resignation, confession, waiver, or salary deduction. Wage deductions and restitution require an independent legal basis and compliance with wage-protection rules.

Dismissal for a proven just cause generally does not carry statutory separation pay, although a collective bargaining agreement, employment contract, established company policy, or a more favorable voluntary grant may provide otherwise. Earned wages and other amounts legally due remain payable.

Internal discipline and criminal proceedings are separate

Falsification or fraud may also raise possible criminal or civil issues, but criminal liability is highly fact-specific. The elements differ depending on the document, the person who made or used it, intent, damage, and surrounding acts. Not every false workplace entry constitutes criminal falsification or estafa.

An employer considering a criminal complaint should preserve original evidence and obtain case-specific legal advice. It should not threaten criminal prosecution merely to force a resignation, repayment, or waiver of labor claims. Employees facing a police, prosecutor, or custodial investigation should obtain independent criminal counsel promptly; an internal HR investigation and a government criminal investigation involve different rights and procedures.

Evidence employees should preserve

An accused employee should lawfully retain or request copies of:

The notice to explain and proof of when it was received;
The written response and proof of submission;
The termination or disciplinary decision;
Relevant policies, handbooks, and collective bargaining provisions;
Job descriptions and records of authority or access;
Legitimately accessible emails, messages, schedules, approvals, and instructions;
Payslips and records of preventive-suspension dates;
Requests for documents, extensions, or a hearing;
Hearing invitations, minutes, and written objections or corrections; and
Names of witnesses with personal knowledge.

Do not delete, alter, backdate, secretly manufacture, or unlawfully take company or personal data. Preserve relevant material in its original form. If access has been removed, identify the records precisely in the written response and request that the employer preserve and consider them.

Employers should similarly retain the complete investigation file, including evidence favorable to the employee, service records, access logs, decision notes, and proof that notices were received.

Common mistakes

Mistakes by employers

Treating an audit exception as conclusive proof of fraud;
Issuing a vague charge that prevents an informed response;
Giving fewer than five calendar days from receipt to answer;
Withholding essential particulars until after the response deadline;
Deciding the outcome before receiving the defense;
Relying on unsigned summaries while ignoring available source records;
Failing to investigate shared passwords, editing rights, or supervisory instructions;
Refusing a written request for a hearing despite material factual disputes;
Using preventive suspension automatically or beyond 30 days without pay;
Applying rules inconsistently to similarly situated employees;
Changing the ground for dismissal only after a complaint is filed; or
Pressuring the employee to resign or sign a quitclaim immediately.

Mistakes by employees

Ignoring the notice or responding only verbally;
Missing the deadline without requesting an extension;
Giving a general denial instead of addressing each transaction;
Failing to request a hearing in writing when credibility or authenticity is disputed;
Altering or deleting relevant files;
Taking confidential records unrelated to the defense;
Signing a resignation, confession, settlement, or quitclaim without understanding it; or
Assuming that the absence of a criminal conviction automatically prevents dismissal.

If dismissal has already occurred

An employee who believes there was no just cause or no fair process may initiate a Request for Assistance under the Single Entry Approach. SEnA provides a 30-calendar-day conciliation-mediation process, subject to the governing rules and exceptions. Requests may be initiated through the DOLE Assistance Request Management System or the appropriate DOLE or NLRC office.

Mandatory conciliation-mediation is generally a prerequisite before an unresolved labor dispute proceeds to the proper agency or Labor Arbiter, as provided by Republic Act No. 10396. Either party may request pre-termination of conciliation and endorsement under the statute.

An illegal-dismissal action generally prescribes four years from accrual. Related money claims may have a different, often shorter, prescriptive period; prompt advice is therefore important. The NLRC’s official FAQ confirms the four-year period for illegal-dismissal complaints.

Where a just cause is proven but the employer omitted statutory procedural due process, the dismissal may remain valid, but nominal damages may be awarded. Under Agabon v. National Labor Relations Commission, the usual award for failure to observe due process in a just-cause dismissal is ₱30,000. If the employer fails to prove a valid cause, the consequences can include a finding of illegal dismissal and the remedies provided by law, subject to the facts and governing decisions.

When legal help is urgent

Seek advice from a Philippine labor lawyer, union representative, DOLE, or the Public Attorney’s Office when applicable if:

A response or hearing deadline is near;
The first notice threatens dismissal but is vague or lacks essential records;
Preventive suspension is approaching or has exceeded 30 days;
The employee is being pressured to resign, confess, repay money, or sign a quitclaim;
Original records may be deleted, overwritten, or altered;
The allegation involves large losses, multiple employees, senior management, or regulated records;
Police, prosecutors, the National Bureau of Investigation, or another government agency has become involved;
The employee faces both a labor case and possible criminal charges;
Retaliation, discrimination, union activity, or whistleblowing may be involved; or
A termination decision has already been served.

Frequently asked questions

Can an employer dismiss an employee immediately after discovering a falsified record?

Ordinarily, no. Even apparently strong evidence does not remove the requirement for a specific first notice, a meaningful opportunity to respond, consideration of the defense, and a separate written decision. A properly justified preventive suspension or narrower access restriction may protect the investigation in the meantime.

Is an admission required before fraud can be established?

No. Fraud may be established through reliable direct or circumstantial evidence meeting the substantial-evidence standard. But silence, an unexplained discrepancy, or access to a system does not automatically prove that the employee deliberately falsified a record.

Must the employer disclose every document in its possession?

Philippine dismissal procedure is not identical to court discovery. Still, the employee must receive enough specific information to understand and answer the charge meaningfully. Withholding the essential transactions or evidence while demanding an immediate answer may make the opportunity to defend illusory.

May the employee have a lawyer or union representative?

The five-day response period is intended to permit consultation with a lawyer or union officer. Representation during an internal meeting may also be governed by the collective bargaining agreement, company rules, or the circumstances of the case. The employee should make the request in writing.

Is a hearing always required?

No. A meaningful written opportunity may be sufficient. A hearing or conference is required when requested by the employee in writing, when substantial evidentiary disputes exist, when company rules or established practice require it, or when comparable circumstances justify it.

Can the employer proceed if the employee refuses the notice or does not attend?

Usually, yes, if the employer can prove proper service and that the employee received a real opportunity to respond. The refusal or absence should be documented. The decision must still rest on substantial evidence, not merely on nonparticipation.

Does repayment erase the offense?

Not necessarily. Repayment may be relevant but does not automatically erase an intentional breach of trust. Nor does a demand for repayment establish guilt. Liability, lawful deductions, restitution, and discipline must each have an adequate legal and evidentiary basis.

Does acquittal in a criminal case require reinstatement?

Not automatically. Criminal and labor proceedings have different elements and standards of proof. The labor finding must nevertheless be independently supported by substantial evidence and reached through proper procedure.

Do these rules apply to government employees?

This discussion principally concerns private-sector employment governed by the Labor Code. National-government personnel, local-government employees, and many government-owned or controlled corporation employees may instead be governed by civil-service laws, administrative disciplinary rules, special charters, and agency procedures. Their applicable rules and appeal periods should be checked separately.

This article provides general Philippine legal information, not legal advice or a prediction of any case. Outcomes depend on the employment status, notices, records, policies, collective bargaining agreement, and evidence. Primary legal and procedural sources were checked as of August 1, 2026.