Quick answer

A Philippine employer may investigate suspected employee fraud or falsified records and may dismiss the employee if the evidence establishes a just cause. But suspicion, an unexplained discrepancy, or a company accusation is not enough. The employer bears the burden of proving the ground by substantial evidence and must observe procedural due process before dismissal.

For a private-sector employee, the minimum process generally requires:

A detailed first written notice identifying the acts, transactions, dates, records, legal ground, and company rules involved.
At least five calendar days from receipt of that notice for the employee to prepare a written explanation.
A meaningful opportunity to answer the charge, submit evidence, and obtain assistance from a representative. A formal hearing is required in specified circumstances.
A fair evaluation of both inculpatory and exculpatory evidence.
A second written notice stating the decision and the reasons for it.

These requirements come from Articles 297 and 292(b) of the Labor Code, DOLE Department Order No. 147-15, and Supreme Court decisions applying the twin-notice rule.

This discussion principally covers private-sector employment. Administrative cases against government personnel follow the separate 2025 Rules on Administrative Cases in the Civil Service. A collective bargaining agreement, employment contract, or company policy may also provide additional protections.

What conduct may justify dismissal?

“Falsification of company records” is not a separate phrase in Article 297 of the Labor Code. Depending on the facts, however, it may fall under one or more recognized just causes:

Serious misconduct connected with the employee’s work
Fraud or willful breach of the trust placed in the employee
Commission of a crime or offense against the employer, an immediate member of the employer’s family, or a duly authorized representative
A cause analogous to the statutory grounds

Examples may include deliberately fabricating invoices, altering official receipts, creating fictitious transactions, falsifying attendance or payroll entries, submitting fake supporting documents, concealing collections, or knowingly using falsified records. The precise ground must match the facts proved.

Not every inaccurate record amounts to fraud. The investigation should distinguish an intentional deception from:

A clerical or encoding mistake
An unclear or inconsistently enforced procedure
A system-generated error
A record changed by someone else
An authorized correction
Negligence without dishonest intent
A good-faith judgment call
Conduct unrelated to the employee’s duties or position of trust

Fraud and dishonesty ordinarily involve a disposition to deceive, defraud, or betray the employer. In one case involving an allegedly altered daily time record, the Supreme Court rejected dismissal because the questioned change accurately reflected that no service had been rendered and the employer failed to establish fraudulent intent. The Court emphasized that minor mistakes or infractions do not automatically justify dismissal. See International Broadcasting Corporation v. Yabut, G.R. No. 229013.

What must the employer prove?

The employer must present substantial evidence—relevant evidence that a reasonable mind could accept as adequate to support the conclusion. Criminal proof beyond reasonable doubt is not required, but unsupported allegations, speculation, and a pre-decided investigation are insufficient.

For dismissal based on loss of trust and confidence, two matters generally must be shown:

The employee held a position of trust and confidence.
A work-related act provided a genuine, factually established basis for the loss of trust.

Positions of trust include managerial employees and rank-and-file employees who routinely handle significant money or property, such as cashiers, auditors, collectors, and property custodians. The actual nature of the work—not the job title alone—controls. The Supreme Court applied these principles to falsified settlement documents and fictitious transactions in Pepsi-Cola Products Philippines, Inc. v. Pacana, G.R. No. 248108.

For rank-and-file employees who do not occupy a fiduciary position, a general claim that management has “lost confidence” is particularly weak. The employer should prove the employee’s participation and should not rely on uncorroborated accusations.

An internal disciplinary case does not require a prior criminal complaint or conviction. Likewise, acquittal in a criminal case does not automatically defeat a labor finding because the standards of proof differ. The employer must still establish substantial evidence in the employment case; a criminal allegation or police report does not prove itself. See Vergara v. NLRC, G.R. No. 117196.

A legally sound investigation process

1. Secure operations without assuming guilt

Immediately protect funds, records, systems, and potential witnesses. Appropriate measures may include changing approval authority, preserving logs, restricting access to the specific system involved, requiring dual controls, or placing relevant records under a legal hold.

Avoid announcing that the employee committed fraud before the evidence has been tested. Use neutral language such as “reported irregularity” or “suspected alteration.”

2. Define the allegation precisely

Identify each questioned transaction or record. A useful allegation matrix should state:

The document or transaction number
The relevant date and amount
What the record originally showed
What was allegedly altered or fabricated
Who created, approved, accessed, or submitted it
The policy or control allegedly violated
The evidence supporting and contradicting the allegation
The possible Labor Code ground

Do not combine unrelated discrepancies into a vague accusation of “fraudulent activities.”

3. Preserve reliable evidence

Preserve originals whenever possible. For electronic evidence, retain the native files, metadata, access logs, audit trails, version history, and a documented forensic or read-only copy. Record who collected each item, when it was collected, where it came from, and every material transfer or examination.

Relevant evidence may include:

Original invoices, receipts, vouchers, time records, expense claims, and approvals
Accounting ledgers and bank or remittance records
System access, edit, print, and download logs
Email and work-platform messages
CCTV footage retained under an applicable workplace policy
Signature specimens and document-routing records
Job descriptions and delegations of authority
Policies, training records, and acknowledgments
Witness statements
Prior versions of the questioned file
Records showing who else had access
Evidence supporting an innocent explanation

Suspend routine deletion of relevant email, CCTV, logs, and backups. Never alter an original record to highlight or annotate it; work from a copy.

Collection and review should also comply with the principles of transparency, legitimate purpose, and proportionality under the Data Privacy Act of 2012. Access to personal devices, private accounts, medical information, or unrelated communications requires particular care. Investigators should collect only what is reasonably relevant and use lawful access methods.

4. Conduct initial fact-finding

Interview witnesses separately and document the questions and answers accurately. Ask how the witness obtained the information instead of accepting conclusions such as “the employee falsified it.”

Check whether:

The employee actually had access or authority
Credentials could have been shared or compromised
The system attributes activity to a user rather than a person
The alleged procedure was documented, communicated, and consistently applied
Corrections or workarounds were previously allowed
Another person created or modified the record
The questioned amount was reconciled elsewhere
The timeline is technically possible
The evidence has been altered or taken out of context

The fact-finding stage may occur before the first notice, but it should not become a secret trial followed by a notice issued only after management has already decided to dismiss.

5. Serve a detailed notice to explain

The first written notice should include:

The specific acts or omissions charged
Dates, amounts, document numbers, and other identifying facts
A detailed narration of the relevant circumstances
The particular company rules allegedly violated
The applicable Article 297 ground
A statement that dismissal or another disciplinary penalty is being considered
Instructions for submitting a written explanation and supporting evidence
The deadline, calculated from the employee’s receipt
Information about any scheduled conference and the right to assistance by a representative

A label such as “fraud,” “dishonesty,” or “falsification of records,” without the underlying facts, is inadequate. The Supreme Court’s notice standards are discussed in King of Kings Transport, Inc. v. Mamac, G.R. No. 166208.

Serve the notice personally or at the employee’s last known address, and preserve proof of service. Email or another agreed channel may supplement service, but the employer should retain reliable evidence that the employee received the notice.

If the investigation uncovers a materially different transaction or new charge, issue a supplemental notice and provide a fresh, reasonable opportunity to answer it. Do not base the final decision on an allegation the employee was never asked to address.

6. Allow at least five calendar days to respond

The employee must receive at least five calendar days from receipt of the first notice. The period exists so the employee can study the accusation, consult a union officer or lawyer, gather evidence, and prepare a defense.

Do not count from the date printed on the notice if it was received later. State an unambiguous due date and document receipt. A reasonable extension should be considered when records are numerous, the employee is ill, relevant documents are controlled by the employer, or another legitimate circumstance prevents a meaningful response.

An employee’s silence after proper notice does not relieve the employer of proving the charge. The employer may decide on the available evidence after the response period and opportunities provided have lapsed.

7. Provide a meaningful opportunity to be heard

“Opportunity to be heard” may be provided through a written explanation, a conference, or another fair and reasonable procedure. A formal hearing is not automatically required in every case.

Under DOLE Department Order No. 147-15, a formal hearing or conference becomes mandatory when:

The employee requests one in writing
Substantial evidentiary disputes exist
A company rule or established practice requires it
Comparable circumstances make a hearing appropriate

Fraud and falsification cases frequently involve disputed authorship, system access, signatures, or competing accounts. A conference is often prudent even when not strictly mandatory.

The employee should be allowed to explain the events, identify evidence and witnesses, answer the evidence relied upon, and receive assistance from a representative or counsel if desired. Internal proceedings do not require courtroom formalities, but the process must be genuine. Keep accurate minutes and allow corrections to material inaccuracies.

The Labor Code does not create full civil-case discovery during an internal investigation. Nevertheless, the notice must disclose enough detail for an intelligent defense. Where a document is central to the charge, reasonable access to it—subject to necessary redactions and confidentiality controls—helps ensure that the opportunity to respond is meaningful.

8. Make a reasoned, proportionate decision

The decision-maker should review the complete record, including evidence favorable to the employee. Consider:

Whether the record was actually false
Whether the employee made, directed, approved, or knowingly used it
Whether the conduct was intentional
Whether the employee’s explanation is consistent with objective records
Whether the act was work-related
The nature of the employee’s position and responsibilities
The materiality and consequences of the act
Whether the policy was known and consistently enforced
Whether dismissal is proportionate to the established misconduct
How comparable cases were treated

A first offense may still justify dismissal when the proven dishonesty is grave and destroys the trust essential to the job. Conversely, calling conduct “dishonest” does not make dismissal proportionate where the evidence shows only a minor mistake, unclear procedure, or good-faith error.

9. Serve the second written notice

If dismissal is justified, the second notice should state:

The charge or charges that were proved
The material evidence considered
The employee’s principal defenses and why they were accepted or rejected
The applicable Labor Code and company-rule grounds
The penalty and effective date
Any turnover, clearance, or return-of-property arrangements

The notice must reflect an actual evaluation. A one-line statement that management “lost trust and confidence” is risky, particularly when the employee raised specific factual defenses.

If the evidence does not establish a dismissible offense, close the case or impose only a lawful, proportionate corrective measure. Do not force a resignation or manufacture another ground.

10. Complete separation obligations

Dismissal for just cause ordinarily does not carry statutory separation pay, although a contract, collective bargaining agreement, or more favorable company policy may provide otherwise.

Final pay should generally be released within 30 days from separation unless a more favorable agreement or policy applies. A certificate of employment should be issued within three days from the employee’s request. These periods appear in DOLE Labor Advisory No. 06-20. A certificate of employment ordinarily states the employee’s engagement and work information; it should not be used to publish unproved accusations.

Preventive suspension during the investigation

Preventive suspension is not an automatic response to a fraud allegation and must not be used as advance punishment.

A private-sector employee may be placed on preventive suspension only when continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. In a records case, the required threat may exist when the employee retains access that could permit further loss, destruction, or tampering—but the employer should document the specific risk.

Preventive suspension without pay may not exceed 30 days for the offense under investigation. After 30 days, the employer must either:

Reinstate the employee to the former or a substantially equivalent position; or
Extend the suspension while paying the employee’s wages and benefits during the extension.

A genuinely separate offense discovered later may support a separate suspension, but employers should not divide one accusation artificially to evade the 30-day limit. The governing rules and their application to suspected fictitious transactions are discussed in Smart Communications, Inc. v. Solidum, G.R. Nos. 197763 and 197836.

Where narrower controls can protect the evidence—such as disabling particular system permissions, changing approval duties, or temporarily reassigning the employee—those measures may be less disruptive.

What an accused employee should do

An employee who receives a notice to explain should act promptly:

Note the exact date and manner of receipt. Signing “received” need not mean agreeing with the accusation; the employee may write “received, not conformity” if appropriate.
Ask in writing for clarification and reasonable access to the documents necessary to answer the charge.
Preserve lawful copies of relevant records already available to the employee. Do not take unrelated confidential data.
Prepare a chronological response addressing each transaction separately.
State clearly what is admitted, denied, or outside the employee’s personal knowledge.
Explain system access, shared credentials, approval flows, authorized corrections, or customary procedures where relevant.
Identify supporting records and witnesses.
Request a hearing in writing when facts, authorship, documents, or witness accounts are substantially disputed.
Consult the union, a lawyer, or another representative promptly.
Keep copies of the notices, response, attachments, proof of submission, hearing minutes, suspension order, and decision.

Do not delete files, alter records, contact witnesses to coordinate stories, sign a confession that is inaccurate, or resign under pressure without understanding the consequences.

Common investigation mistakes

Employer mistakes

Treating an audit discrepancy as proof of fraud
Giving fewer than five calendar days to explain
Using a generic notice with no dates, transactions, or documents
Deciding on dismissal before receiving the explanation
Relying on evidence the employee was never asked to address
Failing to investigate other people with access
Treating a username or device as conclusive proof of identity
Refusing a written request for a hearing despite substantial factual disputes
Extending unpaid preventive suspension beyond 30 days
Ignoring exculpatory evidence or inconsistently applying discipline
Altering originals or failing to preserve metadata and audit trails
Accessing private data indiscriminately
Forcing a resignation instead of completing due process
Omitting the second written notice

Employee mistakes

Ignoring the notice because the accusation seems false
Missing the deadline without requesting an extension
Giving a vague denial instead of answering each transaction
Altering or deleting electronic evidence
Taking confidential company data unrelated to the defense
Signing inaccurate minutes without noting objections
Failing to request a hearing in writing
Relying only on an eventual criminal acquittal
Delaying legal or union advice until after records or deadlines are lost

Consequences of getting the process wrong

If the employer fails to prove a just cause, the dismissal is illegal. The ordinary remedies include reinstatement without loss of seniority rights and full backwages. Separation pay may be awarded instead of reinstatement when reinstatement is no longer feasible, depending on the adjudicated circumstances.

If a just cause is proved but the employer violated procedural due process, the dismissal generally remains valid, but the employer may be ordered to pay nominal damages. Under the prevailing rule from Agabon v. NLRC, G.R. No. 158693, the usual nominal-damages award for a procedurally defective just-cause dismissal is ₱30,000. Other liabilities may arise from separate violations, bad faith, unpaid benefits, unlawful data processing, or an invalid preventive suspension.

When legal help is urgent

Obtain labor-law advice promptly when:

The response deadline is approaching
Preventive suspension is nearing or has exceeded 30 days
The accusation involves a large loss, many employees, or senior management
The employer intends to access personal devices or accounts
Originals, logs, or CCTV may soon be deleted
A criminal complaint, prosecutor’s subpoena, or police request has been received
The employee is being pressured to resign, confess, or sign a quitclaim
The employee was dismissed without a detailed notice or opportunity to answer
A union agreement, whistleblower issue, retaliation claim, or protected personal information is involved

An employee disputing a dismissal may file a Request for Assistance through the Single Entry Approach. Requests may be filed onsite at participating DOLE, NCMB, and NLRC offices or online through DOLE’s Assistance for Request Management System. Mandatory conciliation-mediation generally precedes an NLRC labor complaint.

An illegal-dismissal claim generally prescribes in four years; employment-related money claims generally prescribe in three years. Filing a qualifying SEnA request tolls the applicable prescriptive period under the current NLRC rules. Do not wait until the deadline: evidence and witnesses may disappear much earlier. See the NLRC’s official FAQ and 2025 NLRC Rules of Procedure.

Frequently asked questions

Can an employee be dismissed immediately after falsified records are discovered?

Generally, no. Even apparently strong evidence does not eliminate the twin-notice requirement and the employee’s opportunity to answer. Immediate access controls may be appropriate, but dismissal should follow the required process.

Must the employer prove that the company lost money?

Not necessarily in every case. A deliberate work-related falsification may destroy the trust essential to the position even if the loss was prevented or later recovered. The employer must still prove the dishonest act and its connection to the employee’s work.

Is a confession required?

No. Fraud may be proved through credible documentary, testimonial, or circumstantial evidence. Any admission should be voluntary, accurately recorded, and evaluated with the rest of the evidence.

Does the employee have an absolute right to a lawyer at the company’s expense?

No general rule requires the employer to pay for private counsel in an internal disciplinary investigation. The Labor Code permits the employee to defend themselves with the assistance of a representative if desired, subject to applicable rules, agreements, and circumstances.

Is a formal hearing always required?

No. A meaningful written opportunity can satisfy the hearing requirement. A formal hearing or conference becomes mandatory when requested by the employee in writing, when substantial evidentiary disputes exist, when company rules or practice require it, or when comparable circumstances justify it.

Can the employer continue investigating after the employee submits an explanation?

Yes. The employer may verify the explanation and gather additional evidence. If that process produces a new or materially different charge, the employee should receive a supplemental notice and a fair opportunity to answer before the new matter is used as a basis for discipline.

Can the company file a criminal case as well?

Potentially. Falsified records may separately implicate estafa, falsification, cybercrime, or another offense, depending on the document, conduct, intent, and resulting prejudice. The internal labor case and criminal case have different procedures and standards of proof. A criminal referral should be based on verified facts and reviewed by counsel.

What if the employee refuses to receive the notices?

Document the attempted personal service and serve the notices at the employee’s last known address in accordance with the applicable rules. Refusal does not allow the employer to skip proof of the charge, but a properly documented opportunity that the employee deliberately declines generally permits the process to continue.

Official sources

This article provides general Philippine legal information, not advice for a particular investigation or case. Outcomes depend on the employee’s position, the evidence, applicable company or union rules, and the exact notices and procedures used. Sources and procedures were checked as of 23 July 2026.