Quick answer

An employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. For a lawful termination in the Philippine private sector, the employer must prove a just cause under Article 297 of the Labor Code—commonly fraud or willful breach of trust, serious misconduct, or another applicable cause—using substantial evidence. The employer must also observe procedural due process: a detailed first written notice, a genuine opportunity to answer and present evidence, and a written decision issued only after the defense has been considered.

The employee should ordinarily receive at least five calendar days from receipt of the first notice to prepare a written explanation. A formal hearing is not required in every case, but it becomes necessary when the employee requests one in writing, material facts are genuinely disputed, company rules or practice require it, or similar circumstances make a hearing appropriate.

Fraud, dishonesty, or falsification is not established merely because a document contains an error or irregular entry. The employer must connect the employee to a deliberate, work-related act or culpable omission. The evidence must show more than speculation, rumor, an audit variance, or guilt by association.

These rules primarily concern private-sector employment. Government employees are governed by civil-service and agency disciplinary rules, while a collective bargaining agreement, employment contract, or company code may provide additional safeguards.

What the employer must establish

A defensible disciplinary decision has two separate requirements:

Substantive due process: There must be a valid legal cause supported by substantial evidence.
Procedural due process: The employee must receive proper notice and a meaningful opportunity to defend themselves before dismissal.

Following the two-notice process does not cure a charge unsupported by evidence. Conversely, strong evidence does not excuse failure to provide the required process.

Under Article 297 of the Labor Code, potentially relevant just causes include:

serious misconduct connected with the employee’s work;
fraud or willful breach of the trust placed in the employee;
gross and habitual neglect of duties, when the facts meet both requirements;
commission of a crime or offense against the employer, an immediate member of the employer’s family, or an authorized representative; and
other causes analogous to those specifically listed by law.

The correct ground depends on what happened, the employee’s duties, the applicable policy, and the available evidence. Labels such as “fraud,” “dishonesty,” or “falsification” cannot substitute for proof of specific acts.

Fraud or willful breach of trust

For loss of trust and confidence to justify dismissal, the employee must occupy a position of trust and confidence, and there must be a work-related act that genuinely justifies the loss of trust. This commonly includes managers and employees entrusted with money, inventory, confidential records, approvals, accounting entries, or protection of company property.

The Supreme Court has emphasized that loss of trust must have a real basis, not suspicion, whim, or an after-the-fact justification. The treatment of managerial and rank-and-file employees is not identical. For rank-and-file employees, proof of actual involvement is particularly important; uncorroborated accusations are insufficient. See Cadavas v. Dela Rosa.

Serious misconduct

A dishonest act may also amount to serious misconduct, but the misconduct must be grave, related to the employee’s duties, and indicative that the employee is no longer fit to remain employed. A minor mistake, isolated clerical lapse, or harmless correction does not automatically meet that standard.

The Supreme Court has held that fraud and dishonesty require a dishonest act reflecting a disposition to deceive, defraud, or betray the employer. An alteration that merely corrects an inaccurate entry, without deceptive intent, is not necessarily fraud. See Intercontinental Broadcasting Corporation v. Panganiban.

Substantial evidence—not proof beyond reasonable doubt

The employer bears the burden of proving the valid cause for dismissal. In labor cases, the standard is substantial evidence: relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

This standard is lower than proof beyond reasonable doubt in a criminal case. An employer therefore does not always have to wait for a criminal conviction before completing an administrative case. Likewise, an acquittal or dismissal of a criminal complaint does not automatically resolve the employment case, because the issues and standards of proof differ.

Still, “lower standard” does not mean no standard. Mere allegations, unsupported conclusions, anonymous accusations without verification, or hearsay standing alone may fail to constitute substantial evidence. The employer must establish the employee’s own act, participation, authorization, knowledge, or blameworthy omission.

A fair investigation, step by step

1. Secure records without deciding guilt in advance

Preserve the records that may establish what occurred:

original paper documents and authenticated copies;
accounting records, vouchers, invoices, receipts, payroll files, and approval trails;
system logs, audit logs, access records, and version histories;
relevant work emails, messages, and file metadata;
CCTV footage, subject to privacy and retention rules;
written policies, job descriptions, delegated authority, and process manuals;
witness statements based on personal knowledge; and
records showing custody, handling, or transfer of money, goods, or documents.

Restrict access to people who need the information for the investigation. Record who collected each item, when it was collected, where it came from, and whether it was copied or altered. For digital evidence, preserve the source file and relevant metadata instead of relying only on screenshots.

Do not edit an original document, ask witnesses to coordinate their accounts, or use a resignation letter as a substitute for an investigation.

2. Separate the investigator from the final decision-maker when practical

The person who reported the allegation should not automatically determine the employee’s guilt. For a serious case, use an investigator or panel without a personal conflict, financial interest, or demonstrated bias.

The inquiry should consider both incriminating and exculpatory evidence. It should test alternative explanations such as:

data-entry or software errors;
shared passwords or accounts;
unclear approval authority;
incomplete training;
another person’s access to the record;
a legitimate correction or backdated system posting;
coercion or instructions from a supervisor; or
a control failure unrelated to the accused employee.

3. Identify the precise charge

Before issuing a notice to explain, determine:

the specific act or omission being investigated;
the date, time, place, transaction, and record involved;
the employee’s alleged role;
the policy, duty, or legal ground allegedly violated;
whether intent, knowledge, benefit, concealment, or actual loss is part of the charge; and
what evidence supports the allegation.

Do not charge an entire department merely because several employees had system access. Individual responsibility must be assessed separately.

4. Issue a detailed first written notice

The first notice—often called a notice to explain or NTE—should state that termination is being considered, if that is a possible outcome. It should contain enough detail for an intelligent defense, including:

the particular transaction or document;
the allegedly false entry, alteration, concealment, or unauthorized act;
material dates and circumstances;
the employee’s alleged participation;
the applicable company rule and Labor Code ground;
the evidence or records on which the charge is based, described with reasonable specificity;
the deadline and method for submitting an explanation; and
the employee’s opportunity to submit records, identify witnesses, seek reasonable access to material evidence, and request a hearing in writing.

A notice stating only “fraud,” “falsification,” “dishonesty,” or “loss of trust” is ordinarily inadequate. The Supreme Court requires a detailed narration rather than a general accusation. See Verizon Communications Philippines, Inc. v. E-Villarosa.

The notice should be served personally or at the employee’s last known address, with proof of service. Electronic delivery may supplement—not carelessly replace—a reliable method permitted by the company’s rules and circumstances.

5. Allow at least five calendar days to prepare

“Reasonable opportunity” is generally construed as at least five calendar days from the employee’s receipt of the first notice. The period is intended to allow the employee to study the charge, consult a union officer or lawyer, gather records, and prepare a defense.

A longer period may be fair where the accusation covers numerous transactions, technical records, old files, or evidence controlled by the employer. If a reasonable extension is requested, the employer should decide it objectively and document the reason for granting or denying it.

The employee should acknowledge receipt without being forced to admit the charge. Refusal to sign may be documented by witnesses, but it does not permit the employer to fabricate receipt or shorten the response period.

6. Provide a meaningful opportunity to be heard

The employee may respond in writing, at a conference, or through another fair procedure. The opportunity is meaningful only if the employee can:

understand the accusation;
explain or clarify the relevant events;
submit records and witness information;
challenge material evidence;
identify missing context or alternative explanations; and
receive assistance from a representative or counsel if desired.

A formal trial-type hearing is not automatically required. It becomes mandatory when the employee requests it in writing, substantial evidentiary disputes exist, company rules or established practice require one, or similar circumstances justify it. This rule is explained in Perez v. Philippine Telegraph and Telephone Company and later cases.

For a hearing involving disputed signatures, system access, conflicting witnesses, or alleged document manipulation, a recorded administrative conference is usually prudent. Prepare minutes, identify attendees, mark the records discussed, and give the employee a chance to correct material inaccuracies in the minutes.

7. Evaluate the evidence impartially

The decision-maker should assess:

whether the record was actually false or misleading;
who created, altered, approved, or used it;
whether the employee acted intentionally, knowingly, recklessly, or by mistake;
whether another person had access or authority;
whether the evidence is authentic and internally consistent;
whether witnesses had personal knowledge;
whether the act was work-related;
whether the employee occupied a position of trust;
whether company rules were communicated and consistently enforced;
the gravity of the offense and resulting risk or loss;
the employee’s explanation and supporting evidence;
prior disciplinary history, if legally and fairly relevant; and
whether dismissal is proportionate under the law, policy, CBA, and circumstances.

The finding should address the employee’s main defenses. A decision that merely repeats the accusation may suggest that the explanation was never genuinely considered.

8. Issue a separate written decision

If the charge is not supported, close the case and correct any unnecessary restrictions or reputational harm.

If discipline short of dismissal is warranted, issue a written decision identifying the proven conduct, applicable rule, penalty, and effect of any prior offenses. Follow the company code and CBA, and apply comparable penalties consistently.

If dismissal is justified, serve a second written notice stating:

the material findings;
the evidence relied upon;
the employee’s relevant defenses and why they were accepted or rejected;
the company rule and statutory ground established;
confirmation that all relevant circumstances were considered; and
the effective date of termination.

Do not rely in the dismissal notice on a new charge that was absent from the first notice. If material new misconduct emerges, issue an appropriate additional notice and allow a fresh defense before using it as a ground for discipline.

The employer’s internal decision remains subject to challenge before the appropriate labor tribunal.

Preventive suspension is limited

Preventive suspension is a protective measure, not a punishment. It may be used only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers—for example, a demonstrable risk of further unauthorized transactions, interference with critical records, or tampering with evidence.

It should not be imposed automatically whenever fraud is alleged. Less restrictive measures may be sufficient, such as temporarily removing approval authority, preserving system access logs, reassigning duties, requiring dual authorization, or placing the employee on paid administrative leave.

A lawful preventive suspension ordinarily may not exceed 30 days. If the investigation is not completed, the employer must reinstate the employee to the same position or to payroll; an extension beyond 30 days must not deprive the employee of the salaries and benefits accruing during the extension. The Supreme Court discusses these safeguards in Cadavas v. Dela Rosa and Maula v. Ximex Delivery Express, Inc..

The preventive-suspension period, start and end dates, factual basis, access restrictions, and pay status should be confirmed in writing.

Privacy and confidentiality during the investigation

An employer’s ownership of equipment does not eliminate employee privacy rights. Collection and review of emails, messages, CCTV footage, device contents, biometric data, or other personal information must comply with the Data Privacy Act and the principles of transparency, legitimate purpose, and proportionality.

As practical safeguards:

use a lawful and documented basis for processing personal data;
collect only information relevant and necessary to the investigation;
avoid indiscriminate searches of personal accounts, devices, or unrelated communications;
follow the organization’s published monitoring and acceptable-use policies;
limit disclosure to investigators, decision-makers, counsel, auditors, or authorities with a legitimate need;
use secure storage and access logs;
retain investigation records only as long as justified by law, policy, or a pending dispute; and
avoid announcing accusations to coworkers or posting identifying details in group chats.

The National Privacy Commission states that employees should know the nature, purpose, and extent of workplace monitoring, and that monitoring must be adequate, necessary, and not excessive. See NPC Advisory Opinion No. 2024-003.

Consent is not always the proper basis for workplace processing because an employee may not be free to refuse. Employers should consult their data protection officer before conducting intrusive searches, covert monitoring, forensic imaging, or processing sensitive personal information.

What the employee should do after receiving an NTE

Do not ignore the notice or answer impulsively. Instead:

Record the date and method of receipt. The response period runs from receipt.
Ask for the exact charge, policy provisions, transaction details, and material records if the notice is vague.
Preserve relevant emails, messages, schedules, reports, approvals, receipts, and system information lawfully available to you.
Prepare a dated chronology and identify everyone with personal knowledge.
Explain facts directly. Distinguish what you personally did, what another person did, and what you do not know.
Address each allegation separately and attach clearly labeled supporting records.
Identify shared accounts, delegated access, supervisor instructions, system problems, or control weaknesses when relevant.
Request a reasonable extension in writing if records are voluminous or inaccessible.
Request a formal hearing in writing if key facts are disputed or witnesses and technical evidence need clarification.
Ask to be assisted by a union representative, lawyer, or other permitted representative.
Keep copies of the NTE, response, attachments, hearing request, proof of submission, minutes, suspension order, and final decision.
Do not delete, alter, fabricate, or secretly take confidential company records unrelated to your defense.

A refusal to answer may cause the employer to decide using the available evidence. But an employee facing a parallel criminal investigation should obtain legal advice promptly before giving statements that could affect the criminal case.

Administrative and criminal proceedings are separate

Falsifying commercial, official, or private documents, stealing funds or property, or using false records may create criminal or civil exposure, depending on the precise act and document. The employer may report suspected crime to law-enforcement authorities without waiting for the labor case to finish.

However:

an internal finding is not a criminal conviction;
the employer cannot compel a confession;
the employee retains constitutional rights in a criminal investigation;
criminal guilt requires proof beyond reasonable doubt;
labor liability may still be found on substantial evidence; and
restitution, payroll deductions, civil damages, and final-pay offsets require their own lawful basis.

Do not threaten arrest merely to force a resignation, waiver, repayment, or confession. Employers should obtain counsel before filing a criminal complaint, conducting a forensic seizure, withholding money, or negotiating restitution.

Common mistakes that weaken the case

Mistakes by employers

deciding to dismiss before asking for the employee’s explanation;
using an NTE with only a generic accusation;
giving fewer than five calendar days without a legally defensible reason;
withholding records essential to an intelligent response;
treating an audit discrepancy as automatic proof of fraud;
relying only on hearsay, unsigned summaries, or unverified accusations;
overlooking shared passwords, weak controls, or another person’s access;
refusing a written hearing request despite material factual disputes;
using preventive suspension as punishment or exceeding 30 days without payroll reinstatement;
adding new grounds only in the dismissal notice;
imposing dismissal for an offense that the evidence does not support;
disclosing the accusation broadly and unnecessarily; or
forcing a resignation or quitclaim under threat or humiliation.

Mistakes by employees

missing the response deadline without requesting an extension;
replying only with a blanket denial;
deleting messages or altering files;
signing an admission, resignation, or settlement without understanding it;
failing to request a hearing in writing;
taking confidential originals or unrelated personal data;
contacting witnesses in a way that could be viewed as intimidation; or
assuming that dismissal of a criminal complaint automatically ends the labor case.

Consequences of an unlawful process

If no valid cause is proven, the dismissal may be illegal, potentially resulting in reinstatement and full backwages, subject to the facts and the labor tribunal’s ruling.

If a valid just cause exists but the employer failed to observe statutory procedural due process, the dismissal may remain valid, but the employer may be ordered to pay nominal damages. Under Agabon v. NLRC, the amount commonly applied for dismissal based on just cause without proper procedure is ₱30,000. Other monetary liability may arise from unpaid wages, benefits, final pay, bad faith, or separate violations, but those awards depend on the evidence and legal basis.

When legal help is urgent

Seek assistance promptly when:

the NTE gives fewer than five calendar days or threatens immediate dismissal;
the accusation involves a large amount, multiple employees, regulated records, or senior management;
police, prosecutors, the NBI, or another government agency are involved;
the employer requests access to a personal phone, account, or device;
there is a threat of arrest, public exposure, deportation, license loss, or professional discipline;
the employee is asked to resign, confess, repay money, or sign a quitclaim immediately;
evidence may be deleted, overwritten, or destroyed;
preventive suspension is approaching or has exceeded 30 days;
the employee is a union officer or the dispute may involve unfair labor practice;
the matter involves retaliation for whistleblowing, discrimination, harassment, or protected union activity; or
a termination notice has already been served.

An employee may contest a dismissal before the regional branch of the National Labor Relations Commission. The Labor Code expressly places the burden of proving a valid cause on the employer. Before litigation, labor disputes generally pass through the applicable DOLE Single Entry Approach conciliation process. Do not wait until a possible prescriptive period is close to expiring; obtain case-specific advice immediately.

Frequently asked questions

Is an NTE already a finding of guilt?

No. It should notify the employee of a charge and give a real opportunity to respond. Language showing that guilt and dismissal were already predetermined can undermine the fairness of the process.

Must the employer give the employee every investigation record?

There is no universal rule requiring unrestricted access to every confidential file. But the notice must disclose the material facts in enough detail for an intelligent defense. Where a record is central to the charge, withholding its substance or denying reasonable access may make the opportunity to respond meaningless. Confidential information may be redacted when justified.

Can the employee be dismissed for refusing to submit a written explanation?

Failure to answer allows the employer to evaluate the case on the available evidence; it does not by itself prove fraud. The employer must still establish a valid cause and issue the required decision notice.

Is a hearing always required?

Not necessarily. A meaningful written response may satisfy the opportunity-to-be-heard requirement. A hearing becomes mandatory when requested by the employee in writing, when substantial evidentiary disputes exist, when company rules or practice require one, or when similar circumstances justify it.

Can the employer suspend the employee while investigating?

Only when continued employment poses a serious and imminent threat to life or property. Preventive suspension is generally limited to 30 days. It must not be used as an automatic penalty.

Does the employer need a criminal conviction before dismissal?

No. A labor case uses the substantial-evidence standard, while a criminal conviction requires proof beyond reasonable doubt. The employer must nevertheless have reliable evidence of a valid work-related cause.

Does any false or inaccurate record justify dismissal?

No. The employer must examine who made the entry, whether it was intentionally deceptive, whether it was work-related, the employee’s authority and duties, and the gravity of the act. An honest mistake or legitimate correction is not automatically fraud.

May the employer deduct the alleged loss from salary or final pay?

Not automatically. Wage deductions and offsets require an independent lawful basis. The employer should not treat an internal finding as blanket authority to withhold all salary, benefits, or final pay.

Do probationary employees receive due process?

Yes, when termination is for a just cause. The Supreme Court has confirmed that the two-notice safeguards apply to probationary employees dismissed for just cause. Termination for failure to meet reasonable probationary standards involves a different analysis, including whether the standards were properly communicated.

Official legal sources

This article provides general Philippine legal information, not legal advice or a finding about any particular employee or investigation. Outcomes depend on the evidence, employment status, company rules, CBA, contracts, and other case-specific facts. Official sources and procedures were checked as of July 27, 2026.