Quick answer

A Philippine private-sector employer may investigate suspected employee fraud or falsified records and may impose discipline, including dismissal, only if both requirements are met:

There is a lawful, factually supported ground for the penalty. For dismissal, the employer must prove a just cause under Article 297 of the Labor Code—commonly serious misconduct, fraud, or willful breach of trust—by substantial evidence.
The employee receives procedural due process. Before dismissal, the employee must receive a specific written notice of the charge, at least five calendar days from receipt to explain, a meaningful opportunity to answer and present evidence, and a written notice stating the final decision.

Suspicion, an unexplained discrepancy, or a general accusation of “dishonesty” is not enough. The investigation should identify what record was allegedly falsified, who made or used it, when and how this occurred, what rule or duty was violated, and what reliable evidence connects the employee to the act.

This discussion primarily covers private-sector employment. Government personnel are governed by civil-service disciplinary rules and agency-specific procedures, which can materially differ.

When fraud or falsified records can justify dismissal

Article 297 of the Labor Code allows an employer to dismiss an employee for, among other grounds:

serious misconduct connected with the employee’s work;
fraud or willful breach of the trust placed in the employee;
commission of an offense against the employer, specified family members, or the employer’s authorized representative; or
another cause analogous to those expressly listed.

Examples that may support discipline include intentionally falsifying time records, expense claims, sales reports, inventory records, payroll documents, medical certificates, credentials, receipts, approvals, or electronic transaction records. But the label placed on the conduct is not decisive. The facts must satisfy the legal requirements of the ground actually invoked.

Fraud or willful breach of trust

A willful breach is one committed intentionally, knowingly, and purposely, without a justifiable excuse. Carelessness, an encoding error, or a misunderstanding does not automatically establish fraud.

Loss of trust is most readily applied to:

managerial employees; and
rank-and-file employees who regularly handle money, property, confidential information, approvals, or other matters requiring substantial trust.

Even for employees in positions of trust, dismissal cannot rest on a bare assertion that management has “lost confidence.” The employer must establish facts reasonably showing the employee’s participation and explaining why that conduct makes continued trust untenable. The ground must be genuine, supported, and not invented after the decision to dismiss.

The Supreme Court has emphasized both the willfulness requirement and the need for substantial evidence in Lima Land, Inc. v. Cuevas and JR Hauling Services v. Solamo.

Serious misconduct

Misconduct must generally be:

serious rather than trivial;
connected with the employee’s work;
performed with wrongful intent, not merely through an error in judgment; and
serious enough to show that the employee has become unfit to continue working.

Deliberate falsification used to obtain pay, conceal a shortage, evade controls, or mislead the employer may satisfy this standard. An innocent mistake, disputed interpretation, or irregularity not attributable to the employee may not.

A criminal conviction is not required

An internal employment case and a criminal case are separate. An employer ordinarily need not obtain—or wait for—a criminal conviction before deciding an administrative charge. The employment decision uses the substantial-evidence standard, while criminal guilt must be proved beyond reasonable doubt.

Conversely, filing a police or prosecutor’s complaint does not itself prove a valid dismissal. The employer must still conduct a fair employment process and establish the employee’s responsibility with evidence. See Nicolas v. National Labor Relations Commission.

The required investigation and dismissal process

The controlling procedural requirements appear in DOLE Department Order No. 147-15, which amended the rules implementing Book VI of the Labor Code.

1. Secure the records without deciding guilt in advance

Once a credible issue arises, the employer should preserve relevant records promptly. Depending on the allegation, these may include:

original paper documents and certified copies;
system audit logs and access records;
timekeeping, biometric, CCTV, or entry records;
emails, messages, approvals, and transaction histories;
accounting ledgers, receipts, vouchers, and inventory records;
applicable policies, job descriptions, authority matrices, and prior instructions;
statements from people with personal knowledge; and
information about who created, edited, approved, printed, or possessed the disputed record.

Preserve native electronic files, metadata, access logs, and available backups. Record when evidence was obtained, from whom, and how it was stored. Avoid altering originals or circulating sensitive material unnecessarily.

An investigator should distinguish among:

a system or process failure;
negligence;
unauthorized conduct;
deliberate falsification; and
participation by another employee using shared credentials or access.

A preliminary fact-finding review may occur before a notice to explain, but it should not become a secret adjudication in which guilt and punishment are already fixed.

2. Identify the exact charge and applicable rule

Before issuing a notice, determine:

the specific act or omission attributed to the employee;
the date, place, transaction, and record involved;
the evidence connecting the employee to it;
the company rule, duty, or lawful instruction allegedly violated;
the possible Labor Code ground if dismissal is being considered; and
whether the handbook, collective bargaining agreement, contract, or established practice imposes additional requirements.

Do not charge an employee merely because that person supervised the area where the loss occurred. Individual responsibility must be supported by evidence.

3. Issue the first written notice

The first notice—often called a notice to explain or charge notice—should:

describe the particular acts or omissions in understandable detail;
identify the records, transactions, dates, and circumstances involved;
state the company rules and legal grounds that may apply;
make clear that dismissal is among the possible consequences, if it genuinely is;
give the employee access to enough information to prepare a meaningful response;
invite supporting documents, witness information, or other evidence; and
provide at least five calendar days from receipt for the written explanation.

The five-day period runs from receipt, not simply from the date typed on the notice. A vague accusation such as “fraud, dishonesty, and loss of trust” without the underlying facts does not adequately inform the employee of the case to answer.

Serve the notice personally when practicable and obtain proof of receipt. If personal service is not possible, use the employee’s last known address and a method that provides reliable proof of sending or delivery, consistent with the applicable rules and company procedures.

4. Give a meaningful opportunity to respond

The employee must have a real chance to:

admit, deny, or explain each material allegation;
identify mistakes, system limitations, or other possible actors;
submit documents and other evidence;
identify witnesses;
challenge inaccurate or incomplete records; and
explain mitigating circumstances.

“Ample opportunity to be heard” can be written or verbal and does not always require a trial-type proceeding. A formal hearing or conference becomes necessary when:

the employee requests one in writing;
substantial factual or evidentiary disputes must be resolved;
company rules, established practice, or a collective bargaining agreement require it; or
comparable circumstances make a conference necessary for fairness.

These principles are discussed in Perez v. Philippine Telegraph and Telephone Company.

If the employee asks for more time for a legitimate reason—such as needing access to records, recovering from illness, or locating a material witness—the employer should evaluate the request reasonably and document its decision.

Failure to submit an explanation after proper notice does not automatically prove fraud. The employer must still assess whether its evidence establishes a valid cause.

5. Conduct any necessary conference fairly

If a conference is held:

give reasonable notice of its date, time, place, or online access details;
identify its purpose and the issues to be addressed;
allow the employee to explain and submit relevant evidence;
follow any representation rights under the CBA or company rules;
have an accurate attendance sheet or written record of the proceedings; and
avoid intimidation, forced admissions, or misleading promises.

The investigator should pursue both inculpatory and exculpatory facts. An employee’s refusal to sign minutes should be recorded, but it should not be treated as an admission.

6. Evaluate the complete record under the correct standard

The employer bears the burden of proving the legality of a dismissal. The required quantum is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support the conclusion.

The decision-maker should ask:

Is the questioned record actually false or materially misleading?
Did the employee make, alter, approve, submit, or knowingly use it?
Could another person have used the employee’s device, account, password, or credentials?
Does the evidence show intent, or only negligence or mistake?
Are witness statements based on personal knowledge?
Are screenshots, summaries, and audit reports traceable to source records?
Was the employee’s explanation tested against the records?
Were comparable cases handled consistently?
Is dismissal proportionate to the proven conduct and authorized by law and policy?

Mere allegations do not constitute evidence. In Coca-Cola Bottlers Philippines, Inc. v. Kapisanan ng Malayang Manggagawa sa Coca-Cola, the Supreme Court reiterated that unsupported allegations cannot satisfy the employer’s burden.

7. Issue the second written notice

After considering the employee’s response and all relevant evidence, the employer must issue a written decision. It should:

identify the charge or charges found proved;
summarize the material evidence and the employee’s explanation;
explain why the explanation was accepted or rejected;
identify the applicable rule and legal ground;
state the penalty and its effective date; and
address each material accusation separately if there are multiple charges.

The second notice should reflect an actual evaluation. It should not merely repeat a conclusion prepared before the employee was heard.

If the evidence does not establish the charge, the employer should close the case or impose only a penalty justified by the conduct actually proved. A new or materially different ground should ordinarily be covered by a new, specific notice and another opportunity to answer.

Preventive suspension during the investigation

Preventive suspension is not an automatic response to a fraud allegation and should not be used as an advance penalty.

It is permissible when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. In a records-falsification case, this might exist where the employee retains access that could allow destruction of evidence, further diversion of funds, or manipulation of critical records. The employer should document the actual threat and consider less restrictive safeguards, such as:

temporarily removing approval authority;
preserving or restricting particular system access;
changing passwords or access tokens;
transferring custody of cash, records, or inventory; or
assigning non-sensitive duties.

Preventive suspension ordinarily may not exceed 30 days for an offense. After that period, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the wages and benefits due during the extension. An indefinite or improperly prolonged unpaid suspension can amount to constructive dismissal. The governing principles are explained in Maula v. Ximex Delivery Express, Inc..

Privacy and confidentiality during the investigation

An investigation does not suspend the Data Privacy Act. Collection, review, disclosure, and retention of employee data must have a lawful basis and comply with transparency, legitimate purpose, and proportionality.

Employers should:

collect only information reasonably relevant to the investigation;
restrict access to authorized personnel;
avoid exposing accusations to employees who do not need to know;
secure investigation files and transmission channels;
observe applicable retention and disposal rules;
avoid indiscriminate searches of personal accounts or devices; and
assess separately any sensitive personal information involved.

Data necessary to establish, exercise, or defend legal claims may have a lawful processing basis, but necessity does not authorize unlimited collection or disclosure. Refer to the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

Evidence each side should preserve

For employers

Preserve:

both written notices and proof of receipt;
the employee’s response and attachments;
hearing invitations, minutes, and attendance records;
original or reliably authenticated records;
audit trails and native electronic evidence;
affidavits or signed statements based on personal knowledge;
the applicable policy version and proof it was communicated;
records of similarly situated disciplinary cases;
the preventive-suspension notice and documented threat assessment; and
the written findings showing how the decision was reached.

For employees

Keep copies of:

the notice to explain and envelope, email, or delivery record showing receipt;
the written explanation and proof it was submitted;
the termination or penalty notice;
employment contract, handbook, CBA, and relevant policies;
job description and access or authority limits;
emails, messages, schedules, approvals, and instructions;
screenshots and original files, where lawfully accessible;
payslips, payroll records, and proof of suspension;
requests for records, additional time, or a hearing; and
names and contact details of people with direct knowledge.

Do not delete, alter, secretly manufacture, or unlawfully obtain evidence. Preserve the material as it existed and document its source.

Common mistakes that undermine an investigation

Mistakes by employers

Treating an audit exception as conclusive proof of fraud.
Using a template notice containing only legal labels.
Giving fewer than five calendar days to explain.
Counting the response period from the notice date instead of receipt.
Withholding so much factual detail that the employee cannot answer meaningfully.
Deciding the penalty before receiving the explanation.
Relying on unsigned, unexplained, or unauthenticated summaries while withholding source records.
Assuming that account ownership proves who performed an electronic transaction.
Ignoring evidence favorable to the employee.
Denying a requested hearing despite substantial factual disputes.
Keeping an employee on unpaid preventive suspension beyond 30 days.
Adding new grounds only in the final notice.
Publicly announcing guilt before the investigation is completed.
Ignoring CBA, handbook, or grievance requirements that provide additional protections.

Mistakes by employees

Ignoring the notice or assuming silence cannot be used against the defense.
Submitting a purely emotional denial without addressing each allegation.
Failing to request needed records, additional time, or a hearing in writing.
Altering files, deleting messages, or asking witnesses to coordinate stories.
Signing admissions or waivers without reading them.
Resigning under pressure without documenting what occurred.
Taking confidential company data unrelated to the defense.
Waiting too long to obtain advice or pursue a labor remedy.

What happens if due process or just cause is missing?

The two requirements have different consequences.

No just cause or insufficient evidence

If the employer cannot prove a lawful cause by substantial evidence, the dismissal is illegal. Subject to the facts and applicable rulings, remedies may include reinstatement without loss of seniority rights, full backwages and benefits, or separation pay when reinstatement is no longer feasible. Article 294’s reinstatement and backwages rule is discussed in Guinto v. Sto. Niño Long Range Navigation Services, Inc..

Just cause exists, but dismissal procedure was defective

When a just cause is proved but the employer failed to provide the required statutory process, the dismissal may remain valid, but the employee may receive nominal damages. In Agabon v. National Labor Relations Commission, the Supreme Court awarded ₱30,000 for a just-cause dismissal implemented without proper procedural due process. The result in a particular case still depends on the violations proved and the controlling jurisprudence.

Practical action plan for employers

Stop continuing loss and preserve evidence without publicly accusing anyone.
Separate preliminary fact-finding from the final disciplinary decision.
Identify the exact act, responsible person, policy, and possible legal ground.
Check the contract, handbook, CBA, and prior disciplinary practice.
Use preventive suspension only when a documented serious and imminent threat exists.
Send a detailed first notice and allow at least five calendar days from receipt.
Provide relevant information and fairly evaluate requests for records or additional time.
Hold a conference when requested in writing, when material facts are disputed, or when governing rules require it.
Test electronic and documentary evidence for source, completeness, and attribution.
Consider the employee’s explanation and mitigating or exculpatory evidence.
Decide each charge under the substantial-evidence standard.
Send a reasoned second notice and preserve the complete case file securely.

Practical action plan for employees

Record the exact date and manner in which every notice was received.
Read each allegation separately and identify what facts or documents are missing.
Request relevant records, clarification, reasonable additional time, or a hearing in writing when necessary.
Prepare a chronological, fact-based explanation.
Attach lawfully obtained supporting documents and identify witnesses with personal knowledge.
Explain shared access, system issues, approval limits, customary procedures, or authorized exceptions where relevant.
Avoid destroying or altering any record.
Keep proof that the response was submitted on time.
Obtain prompt union or legal assistance if dismissal, coerced resignation, prolonged suspension, or criminal exposure is possible.
Preserve all employment and payroll records in case a labor complaint becomes necessary.

When legal help is urgent

Seek advice promptly from a labor lawyer, union representative, or appropriate government office if:

the response deadline is about to expire;
the employee is being pressured to confess, resign, or sign a waiver;
preventive suspension is approaching or has exceeded 30 days without paid extension or reinstatement;
critical evidence may be deleted, overwritten, or altered;
the dispute involves large financial losses, regulated records, or sensitive personal data;
management intends to file criminal charges;
the employee has received a dismissal notice;
a CBA grievance deadline may apply; or
retaliation, discrimination, or interference with protected union activity is suspected.

Employees may seek conciliation through the Single Entry Approach and consult the NLRC’s official website, including its SEnA eRequest facility. An illegal-dismissal claim generally prescribes in four years from accrual, while many money claims arising from employment prescribe in three years. Shorter contractual or CBA grievance periods may also matter, so delay is risky.

Frequently asked questions

Must every suspected falsification result in dismissal?

No. The employer must prove the employee’s responsibility, intent where the chosen ground requires it, and a legally sufficient cause. The appropriate result may be dismissal, a lesser penalty, or no penalty, depending on the evidence, the employee’s role, applicable rules, consistency, and proportionality.

Is a notice to explain already a finding of guilt?

It should not be. Its purpose is to state the possible charge and obtain the employee’s side before a decision. Language declaring the employee guilty or dismissed before the response period ends can indicate a predetermined process.

Does the employee always have a right to a courtroom-style hearing?

No. A meaningful written opportunity may be sufficient. A formal hearing or conference becomes necessary when requested in writing, when substantial evidentiary disputes exist, when company rules or a CBA require it, or when similar circumstances justify it.

Can the employer rely on CCTV, emails, or system logs?

Potentially, yes, if the evidence was lawfully obtained, relevant, reliable, and fairly attributed. The employer should preserve the source and context. A screenshot or username alone may not establish who performed an act when credentials or devices were shared.

Can an employee be dismissed for an innocent error in a record?

Not automatically. Fraud and willful breach require deliberate conduct. A genuine error may still raise a negligence or policy issue, but the employer must charge and prove the correct ground rather than relabel every mistake as fraud.

What if the employee refuses to receive or sign the notice?

Refusal to sign does not prevent the employer from documenting a good-faith service attempt and using another reliable method of delivery. It also does not prove the underlying charge.

Can the employer suspend system access immediately?

Reasonable protective restrictions may be appropriate to preserve property, data, or evidence. Removing access is not automatically the same as dismissing the employee, but its scope, duration, pay consequences, and actual effect must be considered. An indefinite exclusion from work may create constructive-dismissal issues.

Does repayment erase the offense?

Not necessarily. Repayment may be relevant to mitigation or restitution, but it does not automatically disprove deliberate falsification or breach of trust. Likewise, requiring repayment does not relieve the employer of proving the charge and observing due process.

Does acquittal in a criminal case require reinstatement?

Not automatically. Criminal and labor proceedings apply different standards. However, the employer still needs substantial evidence of a valid employment ground; the mere filing of a criminal complaint is not conclusive.

Can the employer report suspected fraud to the authorities?

Yes, when there is a factual and legal basis, but internal discipline and criminal reporting are separate decisions. False, reckless, or unnecessarily public accusations may create additional legal exposure. Cases involving possible criminal liability should be reviewed by counsel before statements or evidence are submitted.

Official references

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Employment rights and procedures can depend on the evidence, position involved, company rules, collective bargaining agreement, and later legal developments. Official sources were checked as of August 30, 2026.