Quick answer

An employer may investigate suspected employee fraud or falsified records and, if the charge is supported by substantial evidence, impose proportionate discipline—including dismissal when a just cause under Article 297 of the Labor Code is established. But suspicion, an audit discrepancy, or a criminal accusation does not by itself justify termination.

Before dismissing the employee, the employer should:

preserve and objectively examine the evidence;
give a detailed written notice of the charge;
allow at least five calendar days from receipt for a meaningful written explanation;
hold a conference or hearing when required by the circumstances;
genuinely consider the employee’s defense; and
issue a separate written decision stating the proven facts and ground for dismissal.

The investigation must not be a formality conducted after management has already decided to terminate. The employer bears the burden of proving both a valid cause and compliance with procedural due process.

What conduct may justify discipline or dismissal?

Fraud or falsification may fall under one or more just causes in Article 297 of the Labor Code, including:

serious misconduct;
fraud or willful breach of the trust reposed in the employee;
willful disobedience of a lawful and reasonable work-related order;
commission of a crime or offense against the employer, an immediate member of the employer’s family, or an authorized representative; or
another cause analogous to those expressly listed.

Examples that may warrant investigation include deliberately altering attendance records, expense claims, sales reports, inventory documents, receipts, payroll entries, customer records, medical certificates, credentials, audit documents, or electronic approvals.

The legal ground should match the facts. An employer should not simply label every incorrect entry as “fraud.” Fraud ordinarily involves intentional deception. An honest mistake, clerical error, misunderstanding, weak procedure, or negligent entry is not automatically a willful breach of trust.

The employer must prove the charge by substantial evidence

In an illegal-dismissal case, the employer must establish the lawful cause for dismissal. The applicable standard is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion. This is lower than proof beyond reasonable doubt, but it still requires more than accusation, speculation, or an unsupported belief.

A criminal conviction is not a prerequisite to employment discipline. An employer need not wait for a criminal case to end if its own evidence sufficiently establishes a just cause. Conversely, the mere filing of a police or prosecutor’s complaint does not relieve the employer of its duty to examine the facts fairly.

In Concepcion v. Minex Import Corporation, the Supreme Court explained that employment liability and criminal liability use different standards of proof. Even where a valid cause exists, however, dismissal without the required notices and opportunity to defend oneself violates statutory due process.

When fraud amounts to loss of trust and confidence

Loss of trust and confidence is not a catch-all ground that can be invoked whenever management becomes dissatisfied with an employee. The loss must be genuine, based on clearly established facts, and connected with the employee’s work.

The Supreme Court has identified two broad classes of positions of trust:

managerial employees who exercise significant management powers or effectively recommend managerial actions; and
employees who, in the normal course of their duties, regularly handle significant money, property, records, or other sensitive assets, such as cashiers, auditors, and property custodians.

For dismissal based on loss of trust and confidence, the employer should be able to show that:

the employee occupied a position of trust and confidence;
the employee committed a work-related act that reasonably destroyed that trust; and
the breach was willful—done intentionally, knowingly, and purposely, without a justifiable excuse.

These principles were applied in San Miguel Corporation v. Gomez. The Court stressed that loss of confidence cannot rest on whims, caprice, or suspicion and must not be used as a pretext for an improper dismissal.

For an ordinary rank-and-file employee who does not regularly handle money, property, or sensitive records, the employer should carefully determine whether loss of trust is legally applicable. Another ground, such as serious misconduct, may be more appropriate—but its own elements must still be proved.

A fair investigation should begin with evidence preservation

The employer may secure relevant records before notifying the employee, especially when alteration, deletion, collusion, or further loss is reasonably possible. The purpose must be to preserve evidence and protect legitimate business interests, not to manufacture a case.

Depending on the incident, relevant evidence may include:

original paper records and certified copies;
system audit trails and access logs;
document-creation and modification history;
emails and business-platform messages;
approval workflows and user credentials assigned to each person;
CCTV footage, subject to lawful collection and retention;
transaction records, receipts, invoices, inventory reports, and bank documents;
applicable policies, job descriptions, and training acknowledgments;
witness statements based on personal knowledge;
comparable records from unaffected transactions; and
the employee’s previous explanations or incident reports.

Investigators should document who obtained each item, when it was obtained, where it came from, and whether it was altered or copied. Electronic evidence should be preserved in a manner that retains relevant metadata where practicable.

The investigation should also test alternative explanations. Shared passwords, weak controls, delegated access, faulty software, unclear procedures, or unauthorized use of another employee’s account may materially affect responsibility.

The notice to explain must state the actual accusation

The first written notice—commonly called a notice to explain or charge memorandum—should contain enough detail for the employee to understand and answer the case.

Under DOLE Department Order No. 147-15, the notice should state:

the specific ground or grounds being considered;
a detailed narration of the facts and circumstances;
the particular acts or omissions attributed to the employee; and
the period for submitting a written explanation.

The notice should identify, when known, the questioned records, dates, transactions, amounts, system entries, policy provisions, and the employee’s alleged participation. A vague instruction such as “Explain why you should not be dismissed for fraud” may not provide a meaningful opportunity to defend oneself.

The employer should not disguise a final decision as a notice to explain. Language declaring the employee “guilty” before receiving the response may support an argument that the process was predetermined.

Give at least five calendar days to explain

Department Order No. 147-15 treats at least five calendar days from receipt of the first notice as a reasonable period for the employee to:

study the accusation;
consult a lawyer or representative;
collect records;
prepare an explanation; and
identify or contact witnesses.

The period ordinarily runs from the employee’s receipt of the notice, not merely from the date printed on it. The employer should retain reliable proof of personal, electronic, courier, or other authorized service.

A longer period may be appropriate when the allegations involve numerous transactions, extensive records, technical data, or documents controlled by the employer. A reasonable written request for an extension should be evaluated in good faith.

If the employee refuses to receive the notice, the employer should document the attempted service through witnesses, delivery records, electronic logs, or service at the employee’s last known address, as appropriate. Refusal does not authorize the employer to skip the remaining process.

When is a formal hearing or conference required?

Due process always requires a meaningful opportunity to be heard, but a trial-type hearing is not automatically necessary in every disciplinary case. Under Department Order No. 147-15, a hearing or conference should be conducted when:

the employee requests one in writing;
substantial evidentiary disputes need to be resolved;
company rules or established practice require it; or
similar circumstances make a conference necessary for a fair decision.

Fraud and falsification cases frequently involve disputed signatures, shared system access, document authenticity, conflicting witness accounts, or technical audit findings. In such cases, a conference may be important even if the employee did not initially request one.

At the conference, the employee should be allowed to respond to the material accusations, present evidence, identify witnesses, and address the evidence relied upon. The employee may have the assistance of a representative if desired. The employer may set reasonable rules to keep the proceeding orderly and focused.

Minutes should accurately reflect the attendees, evidence discussed, requests made, and significant responses. They should not be rewritten to create admissions that the employee did not make.

The decision must come after genuine evaluation

After receiving the explanation and completing any necessary conference, the employer should assess:

whether the questioned record was actually false or altered;
whether the employee made, directed, approved, used, or knowingly concealed it;
whether the conduct was intentional;
whether the evidence reliably identifies the responsible person;
whether the act was related to the employee’s duties;
whether an applicable rule was clear and known;
whether the employee’s explanation is supported by records;
whether the position involved trust and confidence;
the gravity of the harm or risk created;
prior offenses, if properly documented and relevant; and
whether dismissal is proportionate to the proven offense.

The second written notice should identify the factual findings, the applicable company rule or statutory ground, the penalty, and the effectivity of the decision. It should be served separately from the first notice and only after the employee’s defense has been considered.

In JARL Construction v. Atencio, the Supreme Court emphasized that an explanation or opportunity given only after termination does not satisfy the required pre-dismissal process.

Preventive suspension is protective, not punitive

An employer may place an employee under preventive suspension while the investigation is pending only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or coworkers.

Preventive suspension should not be automatic merely because “fraud” is alleged. The employer should document the specific risk, such as the employee’s continuing ability to alter records, access funds, influence witnesses, or compromise evidence.

Under the implementing rules of the Labor Code, preventive suspension ordinarily must not exceed 30 days. If the employer extends it, the employee must generally be paid wages and benefits during the extension. A collective bargaining agreement or valid company policy may grant more favorable protections.

Less restrictive measures may sometimes be sufficient, such as temporarily removing system access, changing approval authority, transferring custody of records, or assigning the employee to non-sensitive duties.

A prolonged unpaid suspension may be challenged as punitive, a breach of the suspension rules, or—in sufficiently severe circumstances—constructive dismissal.

Respect privacy and limit access to investigation records

Employers may process relevant personal data for legitimate employment, legal, security, and fraud-prevention purposes, but the investigation remains subject to the Data Privacy Act of 2012 and applicable National Privacy Commission rules.

As a practical matter, the employer should:

collect only information reasonably relevant to the incident;
limit access to persons with an investigative, legal, HR, audit, or decision-making role;
avoid circulating accusations to uninvolved employees;
use secure storage and transmission;
preserve records only for a lawful and defensible period;
distinguish verified facts from allegations; and
avoid accessing purely personal accounts or devices without a valid legal basis.

An investigation does not authorize unrestricted surveillance or public shaming. Announcing an unproven accusation to customers, coworkers, or social media audiences may create separate privacy, defamation, labor, or civil-law risks.

Internal discipline and criminal proceedings are separate

Falsification, theft, estafa, computer-related fraud, or other conduct may also justify referral to law-enforcement authorities. The employer should first preserve authentic records and obtain legal advice on the proper offense, jurisdiction, and evidentiary requirements.

An internal investigator should not threaten arrest, detention, public exposure, or harm to force a confession. A private employer also has no authority to detain an employee against the employee’s will. Any warrantless arrest must comply with the limited circumstances permitted by law.

The employer’s administrative decision should rest on its own evidence. It should not state that the employee has been criminally convicted when no final conviction exists.

If the employee admits the falsification

An admission may be important evidence, but the employer should still establish:

what exactly was admitted;
whether the admission was voluntary;
whether it concerned an intentional falsification rather than an error;
whether the employee understood the questions or document signed;
whether other evidence corroborates the admission; and
whether the admitted conduct satisfies a recognized just cause.

A resignation, quitclaim, or confession obtained through force, intimidation, deception, or an immediate threat of baseless criminal action may be challenged. Even a clear admission does not excuse the employer from issuing the required notices before dismissal.

If the employee does not answer

An employee who knowingly receives a sufficient notice but fails to answer within the reasonable period may waive the opportunity to submit that particular defense. The employer may then decide based on the available evidence.

Silence is not automatically proof of fraud. The employer must still establish the charge through substantial evidence and issue the second written notice.

Before treating the opportunity as waived, confirm that the notice was actually served, the deadline was clear, and any legitimate request for access to necessary records or for a reasonable extension was addressed.

Penalty must be proportionate to the proven offense

Intentional falsification directly connected with money, regulatory compliance, safety, or a position of trust can be grave enough to justify dismissal even for a first offense. But dismissal is not automatically valid whenever a document contains inaccurate information.

Relevant considerations include:

intent and motive;
the employee’s role in creating or approving the record;
the importance of the document;
actual or potential loss;
concealment or repetition;
the employee’s position and degree of trust;
whether the rule expressly treats the act as dismissible;
length and quality of service; and
penalties imposed in materially similar cases.

Long service does not erase serious fraud and may, in a position of trust, even aggravate the betrayal. In less serious or genuinely negligent cases, however, a warning, suspension, restitution arrangement, retraining, or control improvement may be more defensible than termination.

Evidence the employer should retain

A complete case file should ordinarily contain:

the initial report or complaint;
preservation instructions and access restrictions;
originals or authenticated copies of questioned records;
audit methodology and underlying data;
relevant system and access logs;
applicable policies and proof that the employee received them;
job description and description of entrusted functions;
signed or properly documented witness statements;
the first notice and proof of service;
the employee’s explanation and attachments;
requests for documents, extensions, or a hearing;
conference notices, minutes, and attendance records;
the investigator’s factual findings;
the decision-maker’s evaluation;
the termination notice and proof of service; and
records showing consistent treatment of comparable offenses.

The file should preserve evidence favorable to the employee as well as evidence supporting the accusation. Selective retention can undermine the credibility of the investigation.

Evidence the employee should preserve

An employee accused of fraud or falsification should promptly keep lawful copies of:

the notice to explain and proof of when it was received;
the questioned record and surrounding transactions;
emails, messages, instructions, and approval chains;
the applicable policy and job description;
evidence of shared access, delegation, system problems, or prior corrections;
names of witnesses with personal knowledge;
the written explanation and proof of submission;
hearing requests and management’s response;
suspension and termination notices;
payslips, payroll records, and employment documents; and
any communication suggesting that termination was decided in advance.

Do not delete, alter, secretly remove, or destroy company data. Do not access systems after authority has been withdrawn. Preserve only material the employee may lawfully possess and ask that relevant employer-controlled evidence be retained.

Common mistakes by employers

Frequent errors include:

treating an irregularity as conclusive proof of fraud;
using a vague notice that omits dates, records, or particular acts;
giving fewer than five calendar days to answer;
issuing the charge and termination decision simultaneously;
deciding the case before receiving the explanation;
relying on anonymous allegations without corroboration;
ignoring evidence of shared passwords or weak controls;
refusing a necessary hearing despite major factual disputes;
imposing preventive suspension without a serious and imminent threat;
extending unpaid preventive suspension beyond 30 days;
using loss of trust against an employee who did not occupy a position of trust;
relying solely on a pending criminal complaint;
imposing an excessive or inconsistent penalty; and
disclosing unproven accusations to people who have no legitimate need to know.

Common mistakes by employees

Employees can weaken their position by:

ignoring the notice to explain;
submitting only a general denial;
failing to request relevant documents or a hearing in writing;
signing minutes or admissions without reading them;
deleting messages or altering files;
contacting witnesses in a way that may appear coercive;
posting accusations or confidential records online;
assuming that an acquittal automatically defeats the employment case; or
waiting too long to obtain advice or pursue a remedy.

A response should address each allegation separately, attach available evidence, identify missing employer-controlled records, and state clearly whether a hearing is requested.

Consequences of an invalid dismissal

There are two distinct questions:

Was there a lawful and sufficiently proven cause?
Was proper procedure followed?

If no just cause is proved, the dismissal may be illegal, potentially entitling the employee to reinstatement without loss of seniority rights and full backwages, subject to the circumstances and final adjudication.

If a just cause existed but the employer failed to observe statutory due process, the dismissal may remain effective, but the employer may be ordered to pay nominal damages. Under Agabon v. NLRC, the usual benchmark for a just-cause dismissal without proper procedure is ₱30,000, although courts evaluate the governing law and circumstances of the particular case.

What an employee can do after dismissal

An employee who believes that the accusation was unsupported, the investigation was predetermined, or due process was denied may:

obtain copies of the notices, explanation, decision, policy, and employment records;
prepare a dated chronology and secure lawful copies of supporting evidence;
request a Certificate of Employment and computation of final pay;
seek assistance through DOLE’s Single Entry Approach; and
if unresolved, file the appropriate complaint before the National Labor Relations Commission.

An illegal-dismissal action is generally subject to a four-year prescriptive period, while many employment money claims must be filed within three years from accrual. Do not wait for the deadline: the correct cause of action, forum, and computation may depend on the employment relationship and documents.

When legal help is urgent

Seek prompt legal advice when:

the response deadline is approaching;
the employee is being asked to sign a confession, resignation, or quitclaim;
records may soon be overwritten or destroyed;
the accusation involves a large loss, regulated records, or possible criminal liability;
police or prosecutors have become involved;
a preventive suspension is approaching or has exceeded 30 days;
management is withholding access to evidence necessary for a defense;
the employee is being publicly identified as a fraudster;
the case involves union rights, a collective bargaining agreement, or a grievance procedure; or
termination has already occurred and prescriptive periods are running are.

Frequently asked questions

Can an employer investigate without first informing the employee?

Yes. Preliminary fact-finding and evidence preservation may occur before a formal charge, particularly when prior notice could expose records or assets to alteration. Before dismissal, however, the employee must receive a sufficiently detailed written charge and a meaningful opportunity to respond.

Is an audit finding enough to dismiss an employee?

Not automatically. The audit must be reliable, connected to the employee, and sufficient to establish the elements of the asserted just cause. The employee must also be allowed to challenge the audit’s assumptions, source data, and attribution of responsibility.

Must the employer reveal every piece of evidence?

The law requires enough factual detail and a real opportunity to defend against the charge. Whether particular confidential materials must be disclosed in full depends on their relevance, applicable rules, privacy concerns, and whether withholding them makes the opportunity to respond meaningless. Redaction or a relevant extract may sometimes protect third parties while allowing a fair defense.

Can dismissal proceed while a criminal case is pending?

Yes. An internal employment case does not require a prior criminal conviction, and the employer applies the substantial-evidence standard. The employer must nevertheless independently prove a lawful cause and observe procedural due process.

Does acquittal require reinstatement?

Not necessarily. Criminal and labor cases apply different standards and may involve different evidence. An acquittal does not automatically invalidate a dismissal, although its reasons and the underlying evidence may be relevant.

Can the employer place the employee on immediate preventive suspension?

Only when continued employment poses a serious and imminent threat to life or property. The employer should document that risk. Preventive suspension is not supposed to be an advance penalty.

Is a face-to-face hearing always mandatory?

No. A written explanation may provide ample opportunity to be heard in a straightforward case. A hearing or conference should be held when requested in writing, required by company rules or established practice, or necessary to resolve substantial evidentiary disputes or similar circumstances.

Can the employer dismiss an employee who refuses the notice?

Refusal to receive or answer a properly served notice does not prevent the process from continuing. The employer should document the refusal and must still decide the case on substantial evidence rather than treating silence as an automatic admission.

Can falsification justify dismissal for a first offense?

It can, particularly when intentional, work-related, serious, and destructive of trust. Whether dismissal is proportionate depends on the employee’s role, the nature of the document, intent, harm, applicable rules, and the complete circumstances.

Should the employee resign instead of answering?

Not without understanding the consequences. Resignation may affect potential remedies and may be difficult to reverse. An employee should normally preserve the deadline, submit a careful response, and obtain advice before signing a resignation, confession, or quitclaim.

This article provides general legal information, not legal advice for a specific investigation or case. Outcomes depend on the notices, evidence, workplace rules, employment duties, and surrounding facts. Laws and official sources were checked as of August 26, 2026.