Quick answer

An employer may investigate suspected fraud or falsified company records, but suspicion alone does not justify dismissal. For a valid termination in the Philippine private sector, the employer must prove a lawful ground—usually fraud or willful breach of trust under Article 297(c) of the Labor Code—by substantial evidence and follow procedural due process.

Before dismissal, the employee must ordinarily receive:

A detailed first written notice identifying the specific acts or omissions, the applicable company rule and legal ground, and the facts supporting the charge;
A reasonable opportunity to answer—under current DOLE rules, at least five calendar days from receipt of the notice;
A meaningful opportunity to present evidence and obtain the assistance of a representative, if desired; and
A written decision explaining the employer’s findings and the reason for any penalty.

The investigation should remain impartial. Records must be preserved, the employee’s explanation must genuinely be considered, and the penalty must be supported by the evidence and proportionate to the proven offense. Filing a criminal complaint does not replace the company’s disciplinary process.

This discussion principally concerns private-sector employment. Government employees, seafarers, kasambahays, and employees covered by special statutes, regulations, collective bargaining agreements, or sector-specific procedures may have additional or different protections.

What the employer must prove

A lawful dismissal requires both substantive and procedural due process.

Substantive due process: there must be a just cause

Article 297 of the Labor Code permits dismissal for fraud or willful breach of the trust reposed in the employee by the employer or its authorized representative. Depending on the facts, falsification may also be charged as serious misconduct, willful disobedience, or an analogous cause. The employer should identify the ground that actually fits the conduct instead of using several labels without explaining their elements.

Fraud or dishonesty generally requires an intentional act showing a disposition to deceive, defraud, or betray the employer. An innocent encoding error, disputed interpretation, unsupported accusation, or ordinary negligence does not automatically amount to fraud. Intent may be proved through surrounding circumstances, but the conclusion must rest on evidence rather than conjecture.

For loss of trust and confidence, the employer must ordinarily establish:

The employee occupied a position of trust and confidence; and
A work-related, voluntary or blameworthy act provided a real basis for the loss of trust.

Positions of trust include managerial roles and certain fiduciary rank-and-file positions whose regular duties involve significant company money or property, such as cashiers, auditors, or property custodians. The actual duties—not merely the job title—control. For rank-and-file employees, mere uncorroborated allegations are insufficient; there must be proof connecting the employee to the misconduct. Even for managerial employees, loss of confidence cannot be arbitrary or simulated. These distinctions are explained in Bravo v. Urios College, G.R. No. 198066.

The required level of proof

The employer bears the burden of proving a valid cause by substantial evidence: relevant evidence that a reasonable mind might accept as adequate to support the conclusion. Proof beyond reasonable doubt is not required in a labor case, but unsupported accusations, rumors, or self-serving statements ordinarily will not meet the standard.

Evidence may include:

Original or reliably preserved invoices, receipts, vouchers, payroll records, time records, inventory reports, delivery documents, or approval forms;
Audit trails, access logs, system records, and document-version histories;
Emails, messages, and written instructions obtained through lawful company processes;
Specimen signatures or authenticated records used for comparison;
Sworn or signed statements from people with personal knowledge;
Customer, supplier, bank, or logistics confirmations;
CCTV footage and access-control records;
The employee’s admissions, denials, explanations, and supporting documents; and
A documented audit or reconciliation showing what was altered, who had access, and how any discrepancy arose.

In Pepsi-Cola Products Philippines, Inc. v. Pacana, G.R. No. 248108, the Supreme Court upheld dismissal where documentary confirmations, transaction records, third-party statements, and the employee’s own admissions substantially established fraudulent transactions and falsification. The ruling illustrates the importance of a connected evidentiary record—not a rule that every discrepancy proves fraud.

A fair investigation process

1. Secure records without deciding guilt in advance

Preserve the relevant records promptly. Restrict alteration or deletion, make reliable copies, document where each item came from, and record who handled it. For electronic evidence, preserve metadata, access logs, timestamps, account identifiers, and available version history.

Access only information that the company is lawfully entitled to examine. Avoid indiscriminate searches of personal devices or accounts. Follow applicable privacy, cybersecurity, workplace-monitoring, collective bargaining, and records-retention rules.

A sound investigation separates three questions:

What happened?
Who was responsible?
Was the conduct intentional, reckless, negligent, or innocent?

The investigator should test evidence that supports and contradicts the accusation. A decision reached before the employee is heard can make the process appear predetermined.

2. Define the charge precisely

The first notice—often called a notice to explain or NTE—should not merely say “fraud,” “dishonesty,” or “falsification.” It should state, as specifically as available records permit:

The transaction, document, or record involved;
Relevant dates, amounts, document numbers, accounts, and persons;
The entry, signature, alteration, omission, or representation alleged to be false;
The employee’s alleged participation;
The company rule allegedly violated;
The applicable ground under Article 297;
That dismissal is being considered, if that is a possible consequence;
The deadline and method for submitting an explanation; and
How the employee may request relevant records, representation, or a conference.

The notice should contain a detailed narration sufficient for the employee to prepare an intelligent defense. A preventive-suspension notice will not automatically serve as a proper NTE unless it contains the required particulars.

3. Give at least five calendar days to answer

Under DOLE Department Order No. 147-15, the employee should receive at least five calendar days from receipt of the first notice to study the accusation, consult a lawyer or union officer, gather evidence, and prepare a response.

The period runs from receipt, so proof of service matters. Personal service with a signed acknowledgment is preferable. Where that is not possible, use the employee’s last known address or another reliable method allowed by the governing rules, and retain proof of delivery or attempted service.

An employer may allow more time when records are voluminous, the employee reasonably needs documents held by the company, illness or another serious circumstance prevents a timely response, or a CBA or company policy grants a longer period.

Silence or refusal to answer does not relieve the employer of proving the charge. It means only that the employer may decide on the properly disclosed evidence after the response period and required opportunities have passed.

4. Provide a meaningful opportunity to be heard

Due process does not invariably require a courtroom-style hearing. A written explanation and supporting documents may be sufficient when they give the employee a fair and meaningful chance to respond.

A conference or formal hearing becomes necessary when:

The employee requests one in writing;
Material facts or evidence are substantially disputed;
Company rules, established practice, or a CBA requires one; or
Comparable circumstances make a conference necessary for a fair evaluation.

The Supreme Court set out these principles in Perez v. Philippine Telegraph and Telephone Company, G.R. No. 152048.

At the conference, identify the evidence being considered, let the employee explain inconsistencies and submit responsive evidence, permit assistance by a representative if requested, and prepare accurate minutes. The right to be heard means the employee’s submissions must be evaluated—not merely received as a formality.

If the employee denies a signature, challenges an electronic record, identifies another authorized user, or claims that entries were altered after submission, the employer should investigate those issues before deciding. Expert examination may be appropriate where authenticity cannot fairly be resolved through ordinary business records.

5. Decide only on disclosed, supported grounds

The decision-maker should assess:

Whether the evidence establishes the charged act;
Whether the employee was personally involved;
Whether fraudulent or wrongful intent was proved where required;
Whether the conduct was work-related;
Whether the employee actually held a position of trust, if loss of confidence is invoked;
Whether the company consistently enforced the rule;
Whether mitigating or aggravating circumstances exist; and
Whether dismissal is proportionate under the law, company policy, CBA, and relevant jurisprudence.

A dismissal notice should state the proven facts, address the material defenses, identify the violated rule and legal ground, specify the penalty and effective date, and be served on the employee. The second notice must reflect an actual evaluation made after the opportunity to answer.

Preventive suspension during the investigation

Preventive suspension is not an automatic response to an accusation and is not a penalty. It may be imposed only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers.

In a records-falsification investigation, the employer should document why the employee’s continuing access creates that threat—for example, a demonstrated ability to alter relevant files, interfere with audit records, remove property, or compromise the investigation. A generalized fear or the seriousness of the accusation alone may be insufficient.

Preventive suspension ordinarily cannot exceed 30 days. After that period, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the wages and benefits due during the extension. When an initial preventive suspension is justified, wages and benefits are generally not due for that initial period. The rules and limits are discussed in Lagamayo v. CGI Philippines, Inc., G.R. No. 227718.

Less restrictive safeguards should be considered where adequate, such as temporarily disabling sensitive system access, changing approval authority, preserving records, reassigning duties, or requiring supervised access. Any measure must be legitimate and must not become an indefinite suspension, punitive demotion, or disguised dismissal.

Criminal and employment proceedings are separate

Falsified records may also raise criminal, civil, tax, regulatory, or professional issues. The elements and evidence should be assessed separately before making an external accusation.

An employer does not need a criminal conviction before imposing discipline supported by substantial evidence. Conversely, filing a police, prosecutor, or regulatory complaint does not establish just cause and does not cure defects in the workplace process. Labor and criminal proceedings apply different standards of proof, so dismissal of a criminal complaint or an acquittal does not automatically determine the labor case. The Supreme Court discusses this distinction in St. Michael’s Institute v. Santos, G.R. No. 158707.

Employers should avoid threatening criminal prosecution merely to force a resignation, confession, repayment, or waiver. Any settlement or restitution agreement should be voluntary, accurately documented, and reviewed separately from the disciplinary decision.

Evidence employees should preserve

An employee who receives an NTE or suspension notice should keep lawful copies of:

The NTE, suspension order, decision notice, and proof of the dates received;
The employment contract, job description, handbook, code of conduct, CBA, and relevant policies;
The questioned records and earlier or later versions available to the employee;
Approval chains, written instructions, access logs, emails, and work messages;
Documents showing who created, changed, reviewed, or approved the record;
The written explanation and proof that it was submitted;
Requests for documents, additional time, representation, or a hearing;
Minutes, invitations, and correspondence concerning conferences;
Payslips and records of unpaid wages or benefits during suspension; and
A factual timeline identifying witnesses and the location of original records.

Do not delete, alter, backdate, fabricate, or secretly remove company records. Do not access a system after authority has been withdrawn. Preserve evidence through lawful means and ask in writing for material records held by the employer.

If the charge is unclear, the employee should promptly request particulars. If authenticity, system access, or third-party conduct is disputed, state that specifically and identify the evidence needed to resolve it. A response should answer each allegation directly; a blanket denial may leave important documents unexplained.

Common mistakes

Mistakes by employers

Treating an audit discrepancy as automatic proof of fraud;
Issuing a vague NTE without dates, transactions, or the employee’s alleged role;
Giving fewer than five calendar days to respond;
Withholding material information while demanding a detailed explanation;
Deciding to dismiss before receiving or evaluating the defense;
Relying solely on anonymous, hearsay, or uncorroborated accusations;
Assuming every employee occupies a position of trust;
Using preventive suspension without a documented serious and imminent threat;
Extending unpaid preventive suspension beyond 30 days;
Introducing new grounds only in the final dismissal notice;
Ignoring a written request for a conference where one is required;
Applying a harsher penalty than company rules or comparable cases support; or
Assuming a criminal complaint substitutes for labor due process.

Mistakes by employees

Ignoring the NTE or missing the response deadline without requesting an extension;
Resigning impulsively or signing a quitclaim without understanding its effect;
Deleting messages or modifying questioned records;
Making an inaccurate admission to end the meeting quickly;
Responding emotionally without addressing the specific transactions;
Failing to request relevant records or a hearing in writing;
Taking confidential company data unrelated to the defense; or
Waiting too long to seek assistance after dismissal or an extended suspension.

Consequences of an invalid process

If the employer fails to prove a just cause, the dismissal may be illegal even if notices and a hearing were provided. An illegally dismissed employee is generally entitled to reinstatement without loss of seniority rights and to full backwages, subject to the facts, applicable law, and final adjudication. Separation pay may be awarded instead of reinstatement when reinstatement is no longer feasible under controlling law.

If a just cause is proved but the employer failed to observe procedural due process, the dismissal may remain valid, but the employer may be ordered to pay nominal damages. Under the rule originating in Agabon v. NLRC, G.R. No. 158693, the usual amount for a just-cause dismissal implemented without proper procedure is ₱30,000. The result can still depend on the nature of the violation and later controlling jurisprudence.

When legal help is urgent

Promptly consult a labor lawyer, union representative, or qualified worker-assistance office when:

The response deadline is near and the accusation involves many records;
The employee is being pressured to confess, resign, repay money, or sign a quitclaim;
Preventive suspension lacks a stated threat or is approaching 30 days;
The employer refuses access to documents necessary for the defense;
There are disputed signatures, altered electronic records, shared credentials, or possible identity misuse;
A criminal, tax, data-privacy, or regulatory complaint has been threatened or filed;
The investigation involves senior officers, conflicts of interest, retaliation, or whistleblowing;
The employee has already been dismissed without an NTE or meaningful opportunity to respond; or
Evidence may soon be deleted, overwritten, or lost.

An aggrieved worker or employer may request conciliation-mediation through the Single Entry Approach. Requests may be filed onsite with participating DOLE, NCMB, or NLRC offices or online through the official DOLE Assistance for Request Management System. An unresolved illegal-dismissal claim is generally brought before the proper NLRC Regional Arbitration Branch under the 2025 NLRC Rules of Procedure.

An illegal-dismissal action generally prescribes in four years from accrual, while many employment-related money claims are subject to a three-year period. These periods should not be treated as reasons to delay: the correct cause of action, accrual date, venue, and procedural route can depend on the facts. The NLRC’s official FAQ confirms the general four-year period for illegal dismissal.

Frequently asked questions

Can an employee be dismissed immediately after falsification is discovered?

Not merely because management believes the evidence is strong. Unless employment has already ended for another lawful reason, the employee must ordinarily receive the first notice, the response period, a meaningful opportunity to be heard, and a written decision before dismissal takes effect.

Is an actual administrative hearing always required?

No. A meaningful written opportunity may suffice. A conference or hearing becomes necessary when requested in writing, when material evidentiary disputes exist, when company rules or practice require it, or when similar circumstances justify it.

Is five calendar days always enough?

Five calendar days is the regulatory minimum for the explanation period. Fairness may require more time where the evidence is voluminous, necessary records are unavailable, or a CBA or company policy provides a longer period.

Can the employer suspend access to records or systems?

Yes, when done for a legitimate protective reason and in a proportionate manner. Restricting sensitive access is different from imposing an unlawful or indefinite suspension. The employer should still provide reasonable access to material evidence needed for the employee’s defense.

Does repayment erase the offense?

Not necessarily. Restitution may be relevant to mitigation, but it does not automatically remove fraudulent intent or restore trust. Likewise, a demand for repayment does not itself prove that fraud occurred.

Is a confession required to establish fraud?

No. Fraud may be proved through substantial direct or circumstantial evidence. But the evidence must reasonably connect the employee to an intentional or blameworthy act; a discrepancy alone is not enough.

Can an employee refuse to sign a notice?

The employee may decline to sign, but refusal does not necessarily prevent valid service. Signing “received” ordinarily acknowledges receipt, not agreement, especially if the employee writes the date and notes that the signature is for receipt only. The employer should document any refusal and the method of service.

Do these rules apply to probationary employees?

A probationary employee may be terminated for just cause or for failure to meet reasonable standards made known at engagement. If fraud or falsification is the stated just cause, the applicable just-cause notice and opportunity-to-be-heard requirements should be observed. Different notice rules may govern a genuine termination for failure to meet disclosed probationary standards.

Do the same rules govern government employees?

No. Public officers and employees are governed principally by civil-service, agency, Ombudsman, and other public-sector disciplinary rules. Those procedures and penalty classifications should be checked separately.

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. The applicable result depends on the employee’s duties, the documents, workplace rules, CBA provisions, and other facts. Primary legal and procedural sources were checked as of 27 August 2026.