Quick answer

A Philippine private-sector employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. A defensible termination requires both:

A valid just cause supported by substantial evidence, such as serious misconduct or fraud or willful breach of trust under Article 297 of the Labor Code; and
Procedural due process, ordinarily consisting of a detailed first written notice, at least five calendar days from receipt for the employee to explain, a meaningful opportunity to be heard, and a written decision issued only after the defense and evidence have been considered.

Falsification is not an automatic dismissal in every case. The employer must establish what was altered or fabricated, who was responsible, whether the act was intentional and work-related, and why it was serious enough to warrant the chosen penalty. An honest error, unexplained discrepancy, weak audit inference, or accusation unsupported by reliable evidence may not establish fraud.

These rules primarily concern employees of private employers. Government personnel, some seafarers, and employees covered by a collective bargaining agreement or special disciplinary system may be subject to additional or different procedures.

What the employer must prove

The constitutional policy of security of tenure is implemented through Articles 294 and 297 of the Labor Code. For fraud or falsification cases, the most relevant just causes are usually:

Serious misconduct connected with the employee’s work;
Fraud or willful breach of the trust placed in the employee; or
Another legally recognized cause whose elements were specifically stated in the notice.

A false entry may involve a daily time record, payroll document, reimbursement claim, invoice, receipt, sales report, inventory record, medical certificate, approval log, customer record, credential, electronic transaction, or other company document. The label “falsification,” however, does not by itself prove a just cause.

Serious misconduct

Misconduct must be more than a minor lapse. Supreme Court decisions require conduct of a grave and aggravated character, related to the employee’s duties, performed with wrongful intent, and showing that the employee is unfit to remain employed. A company may treat deliberate record manipulation as serious misconduct, but it must still prove the underlying facts. See, for example, G & S Transport Corporation v. Medina.

Fraud or willful breach of trust

The breach must be intentional, knowing, and purposeful—not merely careless, thoughtless, or inadvertent. It must be work-related and founded on clearly established facts. The employer’s claimed loss of confidence must be genuine, not a conclusion invented after the decision to dismiss was already made. These principles are discussed in Bluer Than Blue Joint Ventures Company v. Esteban.

The employee’s actual functions matter more than the job title:

For a rank-and-file employee, the employer must prove involvement in the alleged wrongdoing; uncorroborated accusations are generally insufficient.
For a managerial employee or another employee genuinely occupying a position of trust, a reasonable and substantial basis for believing that the employee committed the breach may support dismissal. Suspicion, whim, or an unsupported audit conclusion still does not suffice.

A deliberate false time entry, for example, has been recognized as possible serious misconduct and fraud when supported by substantial evidence. That does not mean every timekeeping discrepancy warrants dismissal. The surrounding evidence and the employee’s explanation remain essential. See Felix v. National Labor Relations Commission.

The required level of proof

The employer bears the burden of proving a lawful dismissal by substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support the conclusion. This is lower than proof beyond reasonable doubt, but it is more than allegation, speculation, or suspicion.

The employer should be able to connect the evidence to each material conclusion:

The record is false or materially inaccurate;
The employee made, approved, submitted, or knowingly used it;
The employee acted intentionally, if fraud or willful breach is charged;
The conduct was work-related;
The applicable rule or duty was known or reasonably applicable; and
Dismissal, rather than a lesser penalty, is justified under the facts, company rules, past practice, and any applicable agreement.

An employer does not have to await a criminal conviction before completing an employment investigation. Conversely, a prosecutor’s finding of probable cause does not automatically prove the labor case. A criminal acquittal or dismissal also does not automatically invalidate employment discipline because the proceedings use different standards of proof. The employer must still possess its own substantial evidence. See Villanueva v. National Labor Relations Commission and Lagamayo v. CGI Philippines, Inc..

A fair investigation, step by step

1. Secure the records without declaring anyone guilty

Preserve the evidence as soon as a credible concern arises. Appropriate measures may include restricting further alteration of relevant files, suspending transaction authority, making forensic copies, and preserving records scheduled for routine deletion.

Useful evidence may include:

Original paper records and properly authenticated copies;
File metadata, version histories, system logs, access records, and audit trails;
Approval chains and segregation-of-duties records;
Emails, work messages, and attachments obtained through lawful company access;
CCTV footage before the retention period expires;
Accounting records, receipts, bank confirmations, inventory movements, and customer or vendor confirmations;
Applicable policies, training acknowledgments, prior instructions, and job descriptions;
Witness accounts based on personal knowledge; and
Evidence supporting the employee’s explanation, not only evidence pointing toward guilt.

Document who collected each item, when and how it was obtained, where it was stored, and whether an original was altered during examination. Do not overwrite files, recreate missing signatures, or modify the original document to make it easier to read.

2. Define the allegation precisely

Separate suspected facts from assumptions. “Fraudulent activity” is too vague. A workable allegation identifies:

The specific transaction or record;
The relevant date, amount, account, customer, or document number;
The allegedly false entry or omitted fact;
The employee’s alleged action or participation;
The rule, instruction, or duty involved; and
The possible Labor Code ground for discipline.

If the audit uncovers materially different misconduct later, the employer should issue a supplemental or new notice and allow the employee to respond to the new charge. A dismissal should not rest on an accusation that never appeared in the notice to explain.

3. Use a fair fact-finder

Where practical, the investigator should not be the complainant or someone with a personal stake in the outcome. Conflicts should be disclosed. A decision-maker who can objectively review both inculpatory and exculpatory evidence makes the result more defensible.

Interview witnesses separately. Record the questions, material answers, dates, attendees, and documents shown. Avoid threats, coached statements, promises of immunity that the interviewer cannot honor, or pressure to sign a statement the witness has not read.

4. Issue a proper first notice

Under Section 5.1 of DOLE Department Order No. 147-15, the first written notice should contain:

A detailed narration of the material facts and circumstances;
The specific acts or omissions attributed to the employee;
The company rules allegedly violated, if any;
The applicable just cause under Article 297; and
A direction to submit an explanation within a reasonable period.

A reasonable period means at least five calendar days from the employee’s receipt of the notice. This period exists so the employee can study the accusation, consult a lawyer or union officer, gather records, and prepare a defense. A shorter company deadline does not override the DOLE minimum.

Attach or identify the key records needed to understand the charge. Although an internal investigation is not a court trial and does not necessarily require disclosure of the entire investigative file, the employee must receive enough factual detail to answer intelligently. Relevant third-party information may be redacted when necessary.

The notice should be personally served or sent to the employee’s last known address, with reliable proof of service. Email or a workplace messaging system may supplement service, especially where policy permits it, but the employer should not rely on a doubtful electronic delivery record when employment is at stake.

5. Give a meaningful opportunity to be heard

Due process requires a genuine opportunity to answer, present evidence, explain inconsistencies, and rebut the employer’s evidence. It does not always require a courtroom-style hearing.

A formal conference or hearing becomes particularly important when:

The employee requests one in writing;
Substantial factual or evidentiary disputes exist;
A company rule, established practice, CBA, or contract requires one; or
Similar circumstances make a conference necessary for a fair evaluation.

The employee may request the assistance of a lawyer, union officer, or representative. Minutes should accurately reflect material statements, corrections, documents submitted, objections, and attendees. Signing attendance or minutes should not be misrepresented as an admission of guilt.

If an employee knowingly declines to answer after receiving a sufficient notice and reasonable opportunity, the employer may evaluate the case using the available evidence. Silence does not relieve the employer of its burden to prove a valid cause.

6. Test the evidence and the employee’s explanation

Before deciding, check whether:

The employee actually had access or authority to make the questioned entry;
Another user could have used the account, password, stamp, or signature;
The system automatically generated or changed the disputed information;
The record is an original, a reliable copy, or an unauthenticated screenshot;
Witnesses have first-hand knowledge;
The audit method is reproducible and accounts for innocent explanations;
There is evidence of intent, benefit, concealment, repetition, or coordination;
The error was promptly disclosed or corrected;
Similar violations were treated consistently; and
The penalty complies with the code of discipline, CBA, and proportionality considerations.

Do not convert negligence into fraud merely because the result caused loss. If the evidence instead indicates neglect, the employer must determine whether the legal elements of the appropriate ground are present and give notice of that ground before relying on it.

7. Issue a reasoned written decision

Only after considering the explanation, conference record, and all material evidence should the employer decide whether the charge was established.

The second written notice should state:

The material findings;
The evidence relied upon;
How the employee’s defenses were evaluated;
The company rule and statutory ground established;
The penalty and its effectivity; and
Any applicable internal review or appeal procedure.

The decision should not merely say that management has “lost confidence.” It should connect the proven acts to the legal ground. If the evidence does not establish the charge, the employer should close the case or impose only a lawful, proportionate measure supported by the proven conduct.

Preventive suspension during the investigation

Preventive suspension is not an automatic response to a fraud allegation and should not be used as an advance punishment.

For private-sector employment, it may be imposed when the employee’s continued presence creates a serious and imminent threat to the life or property of the employer or co-workers. In a records-falsification case, relevant considerations may include continuing access to funds, inventory, approval systems, witnesses, or records that could be altered.

The ordinary maximum is 30 days for the same offense. After that, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the wages and benefits due during the extension. The employee need not reimburse pay received during a lawful paid extension even if dismissal later follows. These rules appear in the Omnibus Rules Implementing the Labor Code and are applied in Smart Communications, Inc. v. Solidum.

Temporary reassignment, restricted access, supervised work, or paid administrative leave may sometimes protect the investigation with less prejudice to the employee.

Privacy and digital evidence

An employer’s legitimate interest in protecting its operations does not create unlimited authority to collect personal data.

The Data Privacy Act of 2012 requires lawful, fair, transparent, proportionate, and secure processing. Investigators should:

Collect only information relevant and necessary to the defined investigation;
Use a valid legal basis for processing;
Follow existing monitoring, acceptable-use, retention, and privacy policies;
Limit access to persons with a legitimate role;
Secure investigation files and disclosure logs;
Avoid unnecessary circulation of allegations;
Retain records only for a justified period, including anticipated legal claims; and
Avoid accessing personal accounts or devices without lawful authority, an applicable policy, or valid consent.

The National Privacy Commission has advised that employee monitoring must be necessary and proportionate, and that employees should ordinarily be informed of its nature, purpose, scope, and method. Secret or excessively intrusive monitoring is disfavored. See NPC Advisory Opinion No. 2018-084 and the NPC’s CCTV guidance.

What an employee should do after receiving a notice to explain

Record the exact date and method of receipt. The minimum five-calendar-day response period runs from receipt.
Read the allegations against the underlying records. Identify vague dates, missing transactions, incorrect amounts, or rules that were never provided.
Request clarification, relevant documents, or a reasonable extension in writing if genuinely necessary. Do not assume that a request automatically suspends the stated deadline.
Answer each allegation separately. State what you personally did, what you did not do, who else had access, and which facts require correction.
Attach lawful supporting evidence, such as messages, approvals, work instructions, system records, receipts, or witness statements.
Request a conference in writing if credibility, authenticity, access, intent, or other material facts are disputed.
Preserve notices, envelopes, emails, minutes, policies, payslips, suspension orders, and proof of every submission.
Do not delete, alter, conceal, or improperly take company data. Preserve only copies you are lawfully entitled to possess.
Read documents before signing. Correct inaccurate minutes and distinguish acknowledgment of receipt from agreement with the contents.
Consult a lawyer promptly if the explanation may also expose you to a criminal complaint. An internal employment investigation and a criminal case are separate, and statements made in one setting may have consequences elsewhere.

Common mistakes

Mistakes employers should avoid

Deciding to dismiss before receiving the employee’s explanation;
Giving a vague notice that says only “fraud,” “dishonesty,” or “loss of trust”;
Allowing fewer than five calendar days to respond;
Relying on an anonymous tip without corroboration;
Treating a shared password or system login as conclusive proof of authorship;
Ignoring evidence that supports an innocent explanation;
Charging one offense but dismissing for another;
Using an indefinite or unjustified preventive suspension;
Skipping a requested hearing despite a substantial evidentiary dispute;
Circulating accusations beyond those who need to know;
Forcing a resignation, confession, or quitclaim through threats; or
Assuming that a handbook’s “automatic dismissal” clause replaces statutory due process.

Mistakes employees should avoid

Ignoring the notice or responding only with a general denial;
Missing the deadline without requesting an extension;
Altering records after learning of the investigation;
Taking confidential company files without authority;
Signing a confession, resignation, or quitclaim without reading it;
Failing to request a hearing in writing when facts are seriously disputed; or
Waiting for a criminal case to end before challenging an employment decision.

Consequences of getting due process wrong

If the employer fails to prove a just cause, the dismissal is illegal. Available relief may include reinstatement without loss of seniority rights, full backwages, and other relief warranted by the facts.

If a just cause is established but the employer failed to observe statutory procedural due process, the dismissal may remain valid, but the employer may be ordered to pay nominal damages. Under Agabon v. National Labor Relations Commission, the standard award for a procedurally defective just-cause dismissal has commonly been ₱30,000, subject to the controlling law and circumstances when the case is decided.

A dismissed employee may initiate mandatory conciliation-mediation through DOLE’s Single Entry Approach. Requests for assistance may be filed online through DOLE ARMS or onsite at the appropriate DOLE, NCMB, or NLRC office. If unresolved and properly endorsed, a termination dispute generally falls within the jurisdiction of an NLRC Labor Arbiter. Current proceedings are governed by the 2025 NLRC Rules of Procedure.

An illegal-dismissal action generally must be brought within four years from the dismissal, but related money claims may have different prescriptive periods. Waiting can also cause evidence to disappear, so prompt advice is preferable.

When legal help is urgent

Seek individualized labor and, where appropriate, criminal-law advice immediately when:

A notice to explain gives less than five calendar days;
The employee is being pressured to resign or sign an admission;
A personal phone, private account, or unrelated personal data is being demanded;
Preventive suspension is approaching or exceeding 30 days;
The allegation involves forged signatures, theft, estafa, falsification, cybercrime, tax records, or regulated financial transactions;
Police, prosecutors, regulators, or a subpoena are involved;
Important electronic evidence is about to be deleted;
The employee is a union officer or the CBA has a grievance procedure;
The employer intends to dismiss several employees based on the same audit; or
The second notice has already been served and the deadline for an internal appeal, SEnA request, or labor complaint is running.

Frequently asked questions

Can an employee be dismissed as soon as falsified records are discovered?

Not merely because the records look suspicious. The employer must identify the employee’s participation, establish a valid just cause by substantial evidence, and complete the required notice-and-opportunity-to-be-heard process.

Is a formal hearing always required?

No. A meaningful written opportunity may be sufficient. A conference becomes mandatory when the employee requests it in writing, substantial evidentiary disputes exist, a company rule or practice requires it, or comparable circumstances justify one.

Is five calendar days the entire investigation period?

No. It is the minimum reasonable period ordinarily given to the employee to explain after receiving the first notice. The law does not impose a universal five-day deadline for completing the whole investigation.

May the employer decide the case if the employee refuses to answer?

Yes, if a sufficiently detailed notice and a genuine reasonable opportunity were provided. The employer may decide from the available evidence, but it still bears the burden of establishing a valid cause.

Must the employer prove an actual financial loss?

Not necessarily in every fraud or breach-of-trust case. A proven, willful, work-related breach may be serious even if loss was prevented. The absence of actual loss remains relevant when evaluating intent, gravity, proportionality, and the appropriate penalty.

Does an acquittal automatically require reinstatement?

No. Criminal and labor proceedings apply different standards. But an employer cannot rely on the criminal accusation alone; substantial evidence of a lawful employment ground must still exist.

Is separation pay automatically due after a valid fraud dismissal?

Generally, statutory separation pay is not automatically due for a valid just-cause dismissal. A CBA, contract, established company policy, or other applicable rule may provide otherwise. Earned wages and other properly due final-pay components remain payable. Under DOLE Labor Advisory No. 06-20, final pay should ordinarily be released within 30 days from separation or termination, unless a more favorable policy or agreement applies, and a requested certificate of employment should be issued within three days.

Official sources

This article provides general Philippine legal information, not legal advice for a specific investigation or case. Outcomes depend on the employee’s duties, the actual records and evidence, company rules, contracts or CBAs, and the notices given. Laws, procedures, and official guidance were checked against primary government sources as of 23 July 2026.