Quick answer

An employer may investigate suspected employee fraud or falsified records, but dismissal is lawful only if two separate requirements are met:

There is a proven just cause, supported by substantial evidence—not suspicion, rumor, or an unexplained discrepancy; and
Procedural due process is observed, including a specific written charge, a genuine opportunity to answer, any necessary hearing or conference, an impartial evaluation, and a written decision.

Fraud or a willful breach of the employer’s trust is a just cause for termination under Article 297 of the Labor Code. Falsifying a time record, reimbursement claim, sales report, receipt, medical certificate, payroll entry, inventory record, or similar document may fall under that ground—but only when the evidence shows a dishonest, intentional act connected with the employee’s work or responsibilities.

A record that is merely inaccurate does not automatically prove fraud. Employers must distinguish deliberate deception from clerical error, misunderstanding, system failure, negligence, or an act committed by someone else.

What the employer must prove

The employer bears the burden of proving the lawful basis for dismissal by substantial evidence, meaning relevant evidence that a reasonable mind might accept as adequate to support a conclusion. This standard is lower than proof beyond reasonable doubt, but allegations and conjecture are still insufficient.

Depending on the charge, the evidence should establish:

What entry, document, transaction, or representation was false;
Who created, altered, submitted, approved, or used it;
When and how the act occurred;
Why the information was false;
Whether the employee knew it was false;
Whether the act was intended to deceive, obtain a benefit, conceal a loss, or betray the employer’s trust;
How the act related to the employee’s duties; and
Which lawful and known company rule or Labor Code ground was violated.

The Supreme Court has explained that fraud or dishonesty justifies dismissal when the employee’s act reflects a disposition to deceive, defraud, or betray the employer. In one case involving an allegedly altered daily time record, the Court rejected dismissal because the circumstances did not sufficiently establish such dishonest intent: International Broadcasting Corporation v. Yabut, G.R. No. 229013, July 15, 2020.

When loss of trust and confidence applies

Loss of trust is not a catch-all reason for dismissing an employee. It generally applies to:

Managerial employees whose positions require a high degree of confidence; or
Rank-and-file employees who routinely handle significant money, property, records, or other fiduciary responsibilities.

The loss of trust must arise from a willful breach founded on clearly established facts. It cannot be simulated, used as a pretext, or based on the employer’s subjective loss of confidence alone. The alleged breach should also be connected with the employee’s work.

The nature of the position matters. The same irregularity may have different consequences for a cashier entrusted with collections, an accountant controlling financial entries, and an employee who had no custody or authority over the disputed record.

A legally sound investigation process

1. Secure the records without deciding guilt

Preserve the evidence before it can be lost, changed, or overwritten. Appropriate measures may include:

Securing original paper documents;
Preserving the relevant version of an electronic file;
Exporting audit logs and access histories;
Retaining CCTV footage before automatic deletion;
Recording the custody and transfer of physical evidence;
Restricting further access to the affected system or account; and
Identifying witnesses while events remain fresh.

Do not alter an original document by writing notes on it. Work from a copy and retain metadata where electronic authorship, timing, or alteration is disputed.

Preservation should not become harassment or an indiscriminate search. The Data Privacy Act of 2012 and its implementing rules require transparency, a legitimate purpose, and proportionality in processing personal data. Access should be limited to information reasonably necessary for the investigation, and records should be disclosed only to people with a legitimate role.

2. Conduct a neutral preliminary review

The preliminary review should determine whether there is enough factual basis to issue a formal charge. Investigators should test alternative explanations, including:

Data-entry or encoding mistakes;
Shared credentials or unauthorized account use;
Automated system changes;
Supervisor instructions;
Inconsistent procedures;
Missing supporting documents;
Errors by another employee; and
Whether the record accurately reflects what happened despite an apparent alteration.

Where possible, separate the complainant, investigator, and final decision-maker. Anyone with a personal conflict or who has already publicly declared the employee guilty should not control the outcome.

3. Issue a detailed first written notice

If formal disciplinary action is being considered, serve a notice to explain or first notice that states:

The specific acts or omissions charged;
The relevant dates, transactions, documents, amounts, and circumstances;
The company rules allegedly violated;
The applicable just cause under Article 297, if dismissal is being considered;
The possible disciplinary consequence;
The period for submitting a written explanation; and
How and where the employee may respond or request a conference.

A label such as “fraud,” “dishonesty,” or “falsification” is not enough. The notice must contain a sufficiently detailed narration so the employee can intelligently answer the accusation.

Under DOLE Department Order No. 147-15, reasonable opportunity means at least five calendar days from receipt of the notice. This allows the employee to study the charge, consult a lawyer or union officer, gather records, and prepare a defense. The Supreme Court applied this standard in King of Kings Transport, Inc. v. Mamac, G.R. No. 166208, June 29, 2007.

Keep reliable proof of service and receipt. If the employee refuses to acknowledge the notice, document the attempted service through witnesses and use another lawful, reliable means of delivery. A refusal to sign is not, by itself, proof of guilt.

4. Give a real opportunity to answer

The employer must consider the employee’s explanation and evidence in good faith. The process should allow the employee to:

Deny or admit particular allegations;
Explain disputed entries or transactions;
Identify relevant witnesses;
Submit documents, messages, logs, or policies;
Challenge the authenticity, completeness, or interpretation of records;
Explain system access or shared-account issues; and
Raise inconsistent discipline, retaliation, discrimination, or procedural defects.

An employee may consult or be assisted by a lawyer or union representative. However, an internal administrative investigation is not automatically a courtroom proceeding, and technical rules of evidence do not apply with the same strictness.

5. Hold a hearing or conference when required

A formal trial-type hearing is not required in every case. A written explanation may satisfy the opportunity-to-be-heard requirement when it genuinely permits a full defense.

A hearing or conference becomes necessary when:

The employee requests one in writing;
Substantial factual or evidentiary disputes exist;
Company rules, established practice, or a collective bargaining agreement requires it; or
Comparable circumstances make a conference necessary for a fair evaluation.

During a conference, the employee should be allowed to respond to the charge, present evidence, and rebut the evidence against them. Minutes should accurately record attendance, significant statements, submitted exhibits, and unresolved issues. A forced confession or a meeting held only to announce a predetermined result is not meaningful due process.

6. Evaluate the evidence and proportionality

The decision-maker should separately determine:

Whether the alleged act occurred;
Whether the employee committed or participated in it;
Whether the act was intentional and dishonest;
Whether the applicable rule was lawful, reasonable, and known;
Whether the act amounts to an Article 297 just cause;
Whether similar cases were treated consistently; and
Whether dismissal is proportionate under the circumstances.

Relevant circumstances may include the employee’s position, degree of responsibility, amount or property involved, actual or potential damage, concealment, repetition, prior valid offenses, length and quality of service, and whether the offense directly destroyed the trust required by the job.

Length of service does not excuse proven dishonesty and may sometimes aggravate a breach of long-reposed trust. On the other hand, dismissal may be excessive where the evidence establishes only a minor mistake or isolated lapse without dishonest intent.

7. Issue a separate written decision

After considering the employee’s explanation and all relevant evidence, issue a second written notice stating:

The findings on each material charge;
The evidence relied upon;
The reasons the defense was accepted or rejected;
The company rule and legal ground applied;
The disciplinary sanction; and
The effective date, if employment is terminated.

The decision should not rely on a materially different charge that the employee never had an opportunity to answer. If the investigation uncovers a new offense, issue a supplemental or new notice and provide another reasonable opportunity to respond.

Preventive suspension during the investigation

Preventive suspension is not an automatic response to an accusation. It may be used only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. In fraud cases, this may include a demonstrated risk that the employee could alter vital records, interfere with witnesses, access affected funds, or cause further loss.

The notice of preventive suspension should explain the factual basis, scope, and starting date. It should not describe the employee as already guilty.

Preventive suspension ordinarily may not exceed 30 days. After that, the employee must be reinstated to the former or a substantially equivalent position, or the suspension may be extended only if wages and benefits are paid during the extension. The employee does not have to reimburse those payments even if eventually dismissed. These rules are discussed in Artificio v. National Labor Relations Commission, G.R. No. 172988, July 26, 2010.

An unsupported or unnecessarily prolonged suspension can result in back-pay liability and, depending on the complete circumstances, may contribute to a constructive-dismissal claim. Less restrictive safeguards—such as temporary reassignment, revoking system access, dual approvals, or securing records—should be considered when they adequately address the risk.

Internal findings and criminal cases are separate

An internal administrative finding does not itself establish criminal liability. Conversely, an employer does not always have to wait for a criminal conviction before resolving an employment case.

The proceedings have different purposes and standards:

A workplace investigation determines whether company rules or a just cause for discipline has been established by substantial evidence.
A criminal complaint is investigated and prosecuted under criminal law, with guilt at trial requiring proof beyond reasonable doubt.

Employers should avoid using threats of criminal prosecution to force a resignation, confession, waiver, or repayment. If possible criminal conduct, digital forensics, significant losses, or regulatory reporting duties are involved, prompt advice from labor and criminal counsel is advisable.

Evidence each side should preserve

For employers

Preserve:

The original questioned records and verified copies;
System audit logs, metadata, access records, and relevant CCTV;
Written policies and proof they were communicated;
Employment contracts and job descriptions;
Notices, proof of service, written explanations, and conference minutes;
Witness statements based on personal knowledge;
Transaction records and reconciliation reports;
Documents showing who had access or approval authority;
Evidence supporting or disproving dishonest intent; and
Records of discipline in genuinely comparable cases.

Keep an evidence index and chain-of-custody record for important physical or digital materials. Do not backdate notices, reconstruct missing records without disclosure, or ask witnesses to adopt statements they cannot independently verify.

For employees

Preserve lawfully obtained copies of:

The notice to explain and all attachments;
Your written explanation and proof of submission;
The preventive-suspension and termination notices;
Relevant emails, messages, approvals, schedules, and instructions;
Policies, handbooks, and collective bargaining provisions;
Payslips, attendance records, evaluations, and job descriptions;
Names of witnesses with personal knowledge; and
A dated chronology of meetings, access restrictions, demands, and statements.

Do not delete files, alter records, access systems without authority, secretly take privileged or unrelated personal data, or remove original company property. If relevant evidence remains under the employer’s control, identify it specifically in the written explanation and request that it be preserved and considered.

Common mistakes that undermine the process

Employers commonly create legal risk by:

Announcing guilt before the employee answers;
Giving fewer than five calendar days from receipt of the first notice;
Using vague accusations without dates, transactions, or disputed entries;
Relying only on an audit conclusion without its supporting records;
Treating every discrepancy as intentional falsification;
Ignoring evidence that another person had access;
Denying a requested hearing despite substantial factual disputes;
Imposing preventive suspension without an imminent threat;
Keeping an employee unpaid beyond the 30-day limit;
Deciding on an uncharged offense;
Applying rules inconsistently;
Pressuring the employee to resign;
Combining the charge and final dismissal into one notice; or
Using unlawfully or excessively collected personal information.

Employees commonly weaken their position by:

Ignoring the notice to explain;
Giving a general denial instead of answering each allegation;
Missing the response deadline without requesting an extension;
Signing documents without reading or retaining a copy;
Altering or deleting potentially relevant information;
Resigning under pressure without documenting what occurred; or
Assuming that an acquittal or absence of a criminal case automatically decides the labor issue.

Consequences of an unlawful dismissal

If no valid just cause is proven, dismissal is illegal. The usual remedies may include reinstatement without loss of seniority rights and full backwages, subject to the Labor Arbiter’s findings and applicable jurisprudence. Separation pay may be ordered instead of reinstatement in appropriate circumstances.

If just cause is proven but the employer failed to observe procedural due process, the dismissal may remain valid, but the employer can be ordered to pay nominal damages. The Supreme Court’s leading ruling is Agabon v. National Labor Relations Commission, G.R. No. 158693, November 17, 2004. The amount is ultimately determined by the tribunal under the applicable law and circumstances; it should not be treated as a license to bypass due process.

When legal help is urgent

Seek prompt advice from a Philippine labor lawyer, union representative, or appropriate government office when:

A response deadline is about to expire;
The employee is being required to sign a confession, resignation, quitclaim, or repayment undertaking;
Preventive suspension is approaching or has exceeded 30 days;
The accusation involves substantial money, regulated records, trade secrets, or possible criminal charges;
Evidence may soon be deleted or overwritten;
The employee alleges retaliation, discrimination, union-related targeting, or coercion;
The employer plans to inspect private devices, accounts, or communications;
Dismissal has already been announced without a proper process; or
A settlement or quitclaim is being proposed.

Employees may seek assistance through the Single Entry Approach conciliation process or file an appropriate case before the NLRC. The NLRC’s official website provides current contacts and procedural information. Under the 2025 NLRC Rules of Procedure, illegal-dismissal claims generally prescribe in four years, while money claims arising from employment generally prescribe in three years. A request for assistance under the SEnA law tolls the applicable prescriptive period. Waiting is nevertheless risky because records, electronic logs, and witnesses may become unavailable.

Frequently asked questions

Can an employee be dismissed for falsifying a single record?

Possibly. A single deliberate falsification may be serious enough when it proves dishonesty or destroys trust essential to the employee’s position. The result depends on the evidence, intent, nature of the record, employee’s duties, applicable rules, and surrounding circumstances. There is no automatic rule that every first offense requires a lesser penalty.

Is an audit report enough to dismiss an employee?

Not necessarily. An audit can identify discrepancies, but the employer should connect the findings to the employee through reliable supporting records and address innocent or alternative explanations. A conclusion unsupported by its underlying data may not amount to substantial evidence.

Must the employer provide every document in its possession?

The rules require a sufficiently specific charge and a meaningful opportunity to defend. Whether particular records must be disclosed depends on their relevance, confidentiality, applicable policies, collective bargaining provisions, and fairness in the circumstances. A decision should not rest on undisclosed evidence that the employee had no meaningful chance to answer.

Can an employee remain silent?

An employee may choose not to submit an explanation, but the employer may decide the administrative case using the available evidence after a valid notice and genuine opportunity to respond. Silence is not automatically an admission, and it does not relieve the employer of proving just cause.

If answers might affect a criminal investigation, the employee should obtain individualized legal advice before submitting a detailed statement.

Is a lawyer required during the company investigation?

No. A lawyer is not mandatory in every internal investigation, although an employee may seek counsel or union assistance. Representation is especially advisable when criminal exposure, a large claimed loss, complex digital evidence, or immediate dismissal is involved.

Can the employer suspend system access without suspending employment?

Generally, proportionate security measures such as restricting access, requiring dual approval, or temporarily reassigning sensitive duties may be considered within management prerogative, provided they are legitimate, non-punitive, and do not effectively force the employee out or impose an unjustified demotion or loss of pay.

Does repayment erase the offense?

Not automatically. Repayment may affect the assessment of loss or penalty, but it does not necessarily erase an intentional act of fraud or falsification. Conversely, an employee’s offer to correct an error should not automatically be treated as an admission of fraudulent intent.

Does dismissal require a criminal conviction?

No. A labor case uses the substantial-evidence standard and is independent of a criminal prosecution. But an employer must still prove the employment charge with adequate, reliable evidence and observe due process.

Official sources

This article provides general legal information, not legal advice. The validity of an investigation, suspension, or dismissal depends on the actual documents, workplace rules, employee’s position, evidence, and surrounding facts. Official sources were checked as of August 2, 2026.