Quick answer

An employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. For a valid just-cause termination in the private sector, the employer must establish both:

Substantive due process: a lawful ground under Article 297 of the Labor Code, supported by substantial evidence; and
Procedural due process: a specific first written notice, a meaningful opportunity to answer, and a written notice of the final decision.

The first notice must describe the alleged acts and applicable rules in enough detail for the employee to defend themselves. The employee must generally receive at least five calendar days from receipt to submit a written explanation. A formal, trial-type hearing is not always necessary, but it becomes mandatory when the employee requests one in writing, material facts are genuinely disputed, company rules or practice require it, or similar circumstances justify it.

Preventive suspension is not automatic. It is allowed only when the employee’s continued presence poses a serious and imminent threat to life or property. An unpaid preventive suspension generally cannot exceed 30 days; any extension requires reinstatement to work or payroll, including wages and benefits.

Which employment rules apply?

This discussion primarily covers employees of private employers in the Philippines.

Different procedures may govern:

Government officials and employees, who are covered by the 2025 Rules on Administrative Cases in the Civil Service;
Employees covered by a collective bargaining agreement, which may provide additional grievance or disciplinary procedures;
Seafarers and other workers subject to special statutes, contracts, or sector-specific rules; and
Persons whose status as an employee, rather than an independent contractor, is genuinely disputed.

Probationary employees are also entitled to the two-notice procedure when termination is based on alleged fraud or another just cause. Different notice rules apply when probationary employment ends solely because the employee failed to meet reasonable standards made known at the time of engagement.

When fraud or falsification can be a just cause

Article 297 of the Labor Code recognizes several just causes that may be relevant:

Serious misconduct connected with the employee’s work;
Fraud;
Willful breach of the trust placed in the employee;
Commission of an offense against the employer or specified persons; or
A cause analogous to those expressly listed.

Fraud and willful breach of trust are related but are not interchangeable. An employer should identify the particular legal and company-policy ground instead of simply labeling every discrepancy “loss of confidence.”

For dismissal based on willful breach of trust, the employer generally must establish that:

The employee held a managerial position or a fiduciary rank-and-file position, such as a cashier, auditor, property custodian, or another job involving regular custody of significant money or property;
The employee committed an actual, work-related breach;
The breach was intentional, knowing, and purposeful rather than a mere mistake or careless act; and
The established conduct makes the employee unworthy of the trust required by the position.

The Supreme Court has emphasized that loss of trust must rest on substantial evidence, not speculation, arbitrary conclusions, or a justification created after the decision to dismiss. See Jalit v. Cargo Safeway, Inc..

Falsification can also amount to fraud or serious misconduct even when the employee does not occupy a traditional position of trust. For example, the Court has recognized deliberate falsification of time records as potential serious misconduct and fraud. But the result remains fact-specific: the employer must prove who made or authorized the entry, whether it was knowingly false, its connection to work, and any credible explanation. See Felix v. Enertech Systems Industries, Inc..

There is no universal statutory peso threshold at which fraud automatically warrants dismissal. The amount involved may be relevant, but so are intent, position, actual or potential harm, prior record, company policy, and proportionality. Dismissal remains the ultimate employment penalty and should not be imposed mechanically where a lesser sanction would reasonably address the proven offense.

A defensible investigation process

1. Secure records without announcing guilt

As soon as a credible concern arises, preserve relevant records before they can be altered or routinely deleted. This may include:

Original paper documents and certified copies;
Payroll, attendance, accounting, inventory, reimbursement, and approval records;
Emails, messages, system audit trails, access logs, and file histories;
CCTV footage, subject to applicable privacy and retention rules;
Policies, acknowledgment forms, job descriptions, and delegation records; and
Statements from witnesses with personal knowledge.

Restrict access on a need-to-know basis. Avoid public accusations, humiliating announcements, or language stating that the employee is guilty before the evidence and explanation have been considered.

2. Define each allegation precisely

Separate the suspected transactions or records. For each one, identify:

The date or period;
The document, entry, account, or transaction involved;
What information is allegedly false, altered, concealed, or unauthorized;
The employee’s alleged act or participation;
The policy, duty, or approval rule allegedly violated; and
The available supporting evidence.

Do not combine unrelated allegations into a vague charge such as “fraudulent behavior” or “loss of trust.” The employer must later prove the specific acts stated in the notice.

3. Test the evidence before issuing charges

Check for innocent or systemic explanations, including:

Shared passwords or devices;
Delegated authority;
Data-entry, integration, or timekeeping errors;
Backdated corrections permitted by practice;
Conflicting versions of a form;
Approval by a supervisor;
Inadequate training or unclear procedures;
Mistaken identity or duplicate accounts; and
Whether another person had the same access.

A discrepancy proves that something requires explanation; it does not necessarily prove who caused it or that it was deliberate.

4. Issue a detailed first written notice

Under DOLE Department Order No. 147-15, the first notice—commonly called a notice to explain or NTE—should contain:

The specific Article 297 ground or grounds being considered;
The particular company policies allegedly violated, if any;
A detailed narration of the relevant facts and circumstances;
A clear statement that dismissal is among the possible consequences, when that is genuinely being considered; and
A directive to submit a written explanation within a reasonable period.

The reasonable period is at least five calendar days from the employee’s receipt of the notice. A shorter deadline may deprive the employee of time to understand the accusation, consult a lawyer or union officer, gather records, and prepare a defense.

A verbal accusation, audit interview, suspension notice, or general incident report is not a reliable substitute for a legally sufficient first notice. The employer should document personal service. If personal service is not possible, the rules recognize service at the employee’s last known address; the employer should retain proof of dispatch or delivery.

5. Give a meaningful opportunity to answer

The employee should be allowed to:

Answer every allegation;
Submit records and witness statements;
Explain disputed system access, authority, or document history;
Identify evidence requiring verification;
Rebut material evidence relied upon by management; and
Seek assistance from a representative, union officer, or lawyer.

A written explanation may satisfy the opportunity-to-be-heard requirement. However, under Perez v. Philippine Telegraph and Telephone Company, a formal hearing or conference becomes mandatory when:

The employee requests it in writing;
Substantial evidentiary disputes exist;
Company rules or established practice require it; or
Comparable circumstances make a conference necessary for a fair resolution.

An employee’s failure to submit an explanation after valid notice may constitute a waiver of that opportunity. It does not, by itself, prove fraud or relieve the employer of the burden to establish just cause with substantial evidence.

6. Conduct a fair conference when required

The conference need not follow courtroom procedure. It should nevertheless allow the employee and representative to understand the evidence, explain disputed facts, present supporting material, and respond to management’s position.

Prepare accurate minutes. If the meeting will be recorded, obtain proper authorization. Republic Act No. 4200 generally prohibits secretly recording a private communication without authorization from all parties. See the Anti-Wiretapping Act.

7. Evaluate the entire record impartially

The decision should be based on the evidence disclosed and considered during the process—not on new accusations that appeared only after the employee answered.

Ask:

Is the employee’s identity and participation established?
Is the alleged falsity material and intentional?
Are the records authentic and complete?
Are witnesses speaking from personal knowledge?
Was the employee’s explanation verified rather than summarily rejected?
Does the proven act satisfy the selected Article 297 ground?
Is dismissal proportionate under the facts and applicable policy?
Were similar cases treated consistently, absent a legitimate reason for different treatment?

Preparing a termination decision before the employee has been heard can indicate that the investigation was a sham. The Supreme Court rejected inconsistent charges and findings in Foodbev International Consulting Corporation v. Trapago.

8. Issue a separate written decision

If the charge is not established, notify the employee and lift any restrictions or suspension promptly.

If discipline short of dismissal is imposed, state the proven violation, sanction, and effectivity in writing.

If dismissal is justified, issue a second written notice stating that:

The employee’s explanation and the relevant circumstances were considered;
The material findings are identified;
The established facts constitute the stated legal or company-policy ground;
Termination is the penalty selected; and
The effective date is specified.

The second notice must correspond to the charges in the first. An employee should not be dismissed for an allegation they were never given a fair chance to answer. The law does not prescribe a fixed waiting period between the explanation and the decision, but the timing and record must show genuine evaluation.

Preventive suspension: narrow grounds and a 30-day limit

Preventive suspension is a protective measure, not a declaration of guilt or an advance penalty.

It is permissible only when the employer can show that the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. In a fraud investigation, access to money, inventory, systems, or vital records may support suspension when that access creates a real risk of further loss, alteration, or interference. A generic claim that the employee “might affect the investigation” is not enough without supporting circumstances.

The principal rules are:

An unpaid preventive suspension may last no more than 30 days;
After 30 days, the employee must be reinstated to the former or a substantially equivalent position, or placed on payroll;
If the investigation continues beyond 30 days, the extension must be with wages and benefits;
Amounts paid during a proper extension are not refundable even if the employee is ultimately dismissed; and
An unjustified suspension may result in liability for unpaid wages, while an indefinite or improperly extended suspension may support a constructive-dismissal claim.

These limits are discussed in Lagamayo v. Century Properties Management, Inc..

Before imposing preventive suspension, consider whether paid leave, temporary reassignment, dual approval controls, or narrowly tailored access restrictions can protect property without unnecessarily removing the employee from work.

Evidence that should be preserved

For employers

Preserve, where relevant and lawfully accessible:

Native electronic files, not only screenshots or printouts;
Metadata, audit trails, account identifiers, and access histories;
The method and date of extraction;
Names of custodians and persons who handled copies;
Original forms, signatures, correction marks, and approval records;
Policies in effect when the alleged act occurred;
Proof that the employee received or knew the policy;
Witness affidavits based on personal knowledge;
The employee’s explanation and attachments;
Hearing notices, minutes, attendance records, and proof of service; and
The written analysis supporting the final decision.

Electronic documents can be used as evidence, but their authenticity, integrity, and reliability may need to be established. The Rules on Electronic Evidence recognize electronic records while placing the burden of authentication on the party offering them.

For employees

Keep lawful copies of:

The NTE, suspension notice, hearing invitation, and decision;
Proof of the date each notice was received;
Employment contract, job description, and relevant policies;
Written authority, approvals, instructions, or corrections;
Payslips, time records, evaluations, and prior disciplinary history;
Your written explanation and proof of submission;
Requests for records, additional time, representation, or a hearing;
Names of witnesses and a factual timeline; and
Messages showing system problems, shared access, delegated authority, or management knowledge.

Do not delete, alter, or fabricate records. Do not enter company systems after access has been revoked or take trade secrets, customer information, or unrelated personal data. Ask for supervised access or copies of records needed for the defense.

Privacy and lawful evidence gathering

An investigation does not suspend the Data Privacy Act. Employers should identify a lawful basis for processing personal data and observe transparency, legitimate purpose, proportionality, security, and limited retention.

Processing may sometimes be justified by legitimate interests, legal obligations, or the establishment, exercise, or defense of legal claims. That does not authorize unlimited searches or public disclosure. Investigators should:

Collect only information reasonably relevant to the allegation;
Limit access to authorized personnel and advisers;
Redact unrelated personal or sensitive information where practicable;
Avoid searching personal accounts or devices without a clear legal and factual basis;
Secure investigation files against unauthorized disclosure; and
Retain information only as long as justified by law, policy, or anticipated proceedings.

See the Data Privacy Act of 2012, its Implementing Rules, and NPC Advisory No. 2024-02 on processing for legal claims.

Employment and criminal proceedings are separate

Suspected falsification, theft, or fraud may also raise criminal or civil issues. The internal employment investigation and any criminal complaint are separate proceedings with different purposes and standards of proof.

An employer does not necessarily have to wait for a criminal conviction before deciding an employment case. Labor matters generally require substantial evidence, while criminal conviction requires proof beyond reasonable doubt. Conversely, filing a police or prosecutor’s complaint does not itself prove just cause for dismissal.

An employee facing possible criminal exposure should obtain legal advice before submitting a detailed statement. Employers should likewise consult counsel before referring allegations to law enforcement, demanding repayment, or presenting documents whose authenticity or acquisition may be challenged.

Common mistakes

Mistakes by employers

Dismissing immediately after discovering a discrepancy;
Giving fewer than five calendar days to explain;
Using a vague NTE without dates, transactions, acts, or applicable rules;
Charging negligence but deciding the case as fraud or serious misconduct;
Treating silence, denial, or refusal to sign as proof of guilt;
Relying only on anonymous accusations or unverified hearsay;
Ignoring evidence favorable to the employee;
Assuming that a managerial title automatically proves loss of trust;
Holding a hearing only for appearance after the decision has already been made;
Imposing preventive suspension without a serious and imminent threat;
Extending unpaid suspension beyond 30 days;
Secretly recording interviews;
Circulating accusations beyond people who need to know; or
Withholding earned final pay or a certificate of employment as leverage.

Mistakes by employees

Refusing the notice instead of acknowledging receipt with the date;
Treating an acknowledgment signature as an admission without reading the document;
Missing the response deadline without requesting an extension;
Giving only a general denial rather than answering each transaction;
Failing to request a hearing in writing when material facts are disputed;
Deleting messages or modifying files after learning of the investigation;
Obtaining records through unauthorized access;
Signing a confession, resignation, repayment agreement, or quitclaim without understanding it; or
Waiting too long to seek assistance after dismissal or prolonged suspension.

What happens when due process is defective?

If the employer proves a valid just cause but fails to observe procedural due process, the dismissal generally remains valid. However, the employer may be ordered to pay nominal damages. Supreme Court decisions applying the Agabon doctrine have commonly awarded ₱30,000 for a just-cause dismissal made without proper procedure, although the award is judicial, not an automatic statutory fine. See Agabon v. NLRC and King of Kings Transport, Inc. v. Mamac.

If the employer fails to prove just cause, the dismissal may be illegal even when notices and a hearing were provided. Depending on the final ruling and circumstances, remedies may include reinstatement, full back wages, or separation pay in lieu of reinstatement, plus other properly proven relief.

A valid just-cause dismissal ordinarily does not carry statutory separation pay. It does not erase earned wages and benefits. Under DOLE Labor Advisory No. 06-20, final pay should generally be released within 30 days from separation or termination, unless a more favorable policy or agreement applies. A certificate of employment should be issued within three days from the employee’s request.

When legal help is urgent

Seek prompt assistance when:

The employee is being asked to sign a confession, resignation, quitclaim, or repayment agreement;
The response period is about to expire;
A formal hearing has been denied despite a written request or major factual dispute;
Preventive suspension is approaching or has exceeded 30 days without reinstatement or payroll placement;
Records may be destroyed, overwritten, or remotely altered;
Personal devices, private accounts, privileged communications, or sensitive information are being demanded;
The suspected conduct may lead to a criminal complaint;
Retaliation, discrimination, union activity, or whistleblowing may be involved;
A termination decision has already been issued; or
An NLRC, prosecutor, court, or government-agency notice has been received.

An employee or employer may submit a Request for Assistance through DOLE’s Assistance for Request Management System or file onsite at an authorized Single Entry Assistance Desk. Under the current SEnA rules, most labor disputes first undergo up to 30 days of mandatory conciliation-mediation, subject to applicable exceptions or early referral.

An illegal-dismissal action generally has a four-year prescriptive period from dismissal, while employment-related money claims generally prescribe in three years from accrual. These periods should not be treated as reasons to delay: evidence disappears, records are overwritten, and separate procedural deadlines may be much shorter.

Frequently asked questions

Can an employee be dismissed based only on an audit finding?

Not automatically. An audit finding may justify an investigation, but the employer must connect the discrepancy to the employee through substantial evidence, determine whether the conduct was intentional and work-related, provide due process, and impose a proportionate penalty.

Must the employer provide every piece of evidence with the NTE?

The governing rule expressly requires specific grounds and a detailed factual narration, not necessarily attachment of every document. However, the employee must receive enough information and a meaningful opportunity to answer. Where particular records are material to the defense, fair access, inspection, copies, or appropriate redacted extracts may be necessary.

Is five calendar days always enough?

Five calendar days is the minimum reasonable period stated in Department Order No. 147-15. More time may be appropriate where the records are voluminous, the employee is ill, access to documents is delayed, or the issues are complex. An employee who needs more time should request an extension in writing before the deadline.

Is an actual hearing always required?

No. A meaningful written opportunity may be sufficient. A hearing or conference becomes mandatory when requested by the employee in writing, substantial factual disputes exist, company rules or practice require it, or similar circumstances justify it.

Can the employee bring a lawyer or union representative?

The employee may seek the assistance of a representative, union officer, or lawyer. The request and the representative’s identity should be communicated in advance, particularly when a hearing is scheduled.

Can the employee be preventively suspended immediately?

Only when the employer has a factual basis to conclude that continued presence creates a serious and imminent threat to life or property. The suspension must not be used as punishment or as a routine response to every allegation.

Does an acquittal in a criminal case require reinstatement?

Not necessarily. Criminal and labor proceedings use different proof standards. An acquittal does not automatically defeat a dismissal supported by substantial evidence, but neither does the filing of a criminal complaint establish valid dismissal.

May the employer deduct the alleged loss from final pay?

Not simply because management alleges fraud. Wage deductions and setoffs require an independent lawful basis and must comply with labor rules, contracts, and due process. Disputed liability should not be treated as conclusively established without proper authority or agreement.

Does refusing to sign a notice stop the investigation?

No. The employer may document valid service and proceed. The employee may sign only to acknowledge receipt, note the actual date, and state that the signature is not an admission.

Must a valid just-cause termination be reported to DOLE 30 days in advance?

The 30-day advance notice to DOLE applies to specified authorized-cause terminations, not an ordinary Article 297 just-cause dismissal. A fraud-based dismissal instead requires the two written notices and a meaningful opportunity to be heard.

Official sources

This article provides general legal information, not legal advice or a prediction of any case. The correct procedure and outcome depend on the employment relationship, governing policies or CBA, notices, evidence, and surrounding facts. Sources and procedures were checked as of 25 July 2026.