Quick answer

An employer may investigate suspected employee fraud or falsified records and may dismiss an employee if the facts establish a just cause under the Labor Code. But an accusation, audit variance, unsigned report, or general “loss of trust” is not enough by itself.

For a valid private-sector dismissal, the employer must establish both:

Substantive due process: a lawful ground supported by substantial evidence; and
Procedural due process: a specific first written notice, at least five calendar days from receipt for the employee to explain, a meaningful opportunity to present and rebut evidence, and a written decision after the defense has genuinely been considered.

A formal trial-type hearing is not required in every case. It becomes mandatory when the employee requests one in writing, material facts are genuinely disputed, company rules or practice require it, or similar circumstances make a conference necessary.

These rules principally cover private-sector employment. Government personnel, seafarers, overseas workers, kasambahays, and employees covered by a collective bargaining agreement may be subject to additional or different procedures.

Fraud or falsification must amount to a lawful ground for discipline

Article 297 of the Labor Code, formerly Article 282, permits dismissal for causes that may apply to fraudulent transactions or falsified records, particularly:

Serious misconduct;
Fraud or willful breach of the trust placed in the employee;
Gross and habitual neglect, if the facts support it; or
Another cause truly analogous to those listed in the law.

The employer should identify the correct ground instead of using every possible label.

Serious misconduct

Misconduct must be grave, related to the employee’s work, committed with wrongful intent, and serious enough to show that the employee has become unfit to continue working for the employer. An innocent mistake, poor judgment, clerical error, or isolated procedural lapse is not automatically serious misconduct.

Knowingly falsifying time records, transaction documents, reimbursement claims, inventory records, approvals, or company forms can constitute serious misconduct when the employee’s participation and wrongful intent are proven. In one case involving forged requisition forms, the Supreme Court relied on several mutually supporting records and witness statements—not merely the existence of forged documents—to uphold the dismissal. See PLDT, Inc. v. Domingo, G.R. No. 197402, June 30, 2021.

Fraud

Fraud requires conscious and intentional deception. It must have been done knowingly and purposely, not merely through carelessness, negligence, or inattention.

The Supreme Court has rejected a fraud charge where the employer failed to present transaction records or screenshots showing why an employee’s account adjustment was supposedly fraudulent. Suspicion and speculation could not substitute for proof. See Globe Telecom, Inc. v. Ebitner, G.R. No. 242286, January 16, 2023.

Willful breach of trust or loss of confidence

Loss of trust is not a catch-all ground. Ordinarily, the employer must establish that:

The employee held a position of trust and confidence;
A real, work-related act justified the loss of trust;
The breach was intentional, knowing, and without justifiable excuse; and
The loss of trust was genuine, not a pretext for an improper dismissal.

Positions of trust generally include managerial employees and fiduciary rank-and-file workers who routinely handle significant money, property, confidential transactions, audits, or comparable responsibilities. A rank-and-file employee does not become a fiduciary employee merely because the employer says every worker is trusted.

For rank-and-file employees, proof of actual participation is especially important. Mere uncorroborated accusations are insufficient. The governing principles are discussed in San Miguel Corporation v. Gomez, G.R. No. 200815, August 24, 2020.

The employer carries the burden of proof

If dismissal is challenged, the employer must prove its legality through substantial evidence—relevant evidence that a reasonable person could accept as adequate to support the conclusion.

This is lower than proof beyond reasonable doubt in a criminal case, but it still requires more than allegation or conjecture. The investigation should connect the employee to the questioned record or transaction through reliable facts, such as:

Original or native transaction records;
Audit trails and system-access logs;
Approval histories and user credentials;
Emails or work messages in their full context;
CCTV footage lawfully collected and retained;
Signed, specific, first-hand witness statements;
Specimen signatures or authenticated comparison records;
Inventory, cash, bank, delivery, or receiving records;
Proof of who had access to the system or document;
Evidence of motive, benefit, concealment, or coordinated conduct, where relevant; and
The employee’s explanation and supporting evidence.

An audit shortage may establish that something went wrong, but it does not necessarily establish who caused it. Shared credentials, weak controls, missing originals, hearsay, inconsistent figures, or unexplained gaps in custody can materially weaken the case.

A fair investigation process

1. Secure the evidence without presuming guilt

The employer should promptly preserve relevant records, restrict unauthorized access, and document who collected or handled each item. For digital records, preserve native files, metadata, access logs, and reliable copies. Avoid editing screenshots or exporting only selected messages that remove surrounding context.

Evidence preservation should be proportionate. An investigation does not give unrestricted authority to search an employee’s personal phone, personal email, cloud account, or private conversations.

Under the Data Privacy Act, workplace monitoring and collection of employee data must have a lawful basis and comply with transparency, legitimate purpose, proportionality, security, and retention requirements. The National Privacy Commission explains these principles in Advisory Opinion No. 2018-084 on employee monitoring.

2. Conduct neutral preliminary fact-finding

Before accusing anyone, determine:

What record or transaction is allegedly false;
What makes it false;
When and how it was created or changed;
Who could access or approve it;
What company rule or legal duty may have been violated;
Whether the discrepancy may have an innocent or system-related explanation; and
Whether other employees or control failures may be involved.

An investigator should disclose conflicts of interest and avoid coaching witnesses. Confidentiality should be limited to those who need the information, but no one should be promised absolute secrecy if the substance of their evidence must later be disclosed for a fair defense.

3. Issue a detailed first written notice

If the preliminary facts could justify discipline or dismissal, the employee should receive a notice to explain that states:

The specific acts or omissions charged;
Relevant dates, transactions, documents, amounts, and circumstances;
The particular company rules allegedly violated;
The applicable just cause under Article 297;
That dismissal is a possible consequence if the charge is proven; and
A direction to submit a written explanation within at least five calendar days from receipt.

A vague instruction to “explain the audit variance” or answer “dishonesty allegations” is generally inadequate. The employee must have enough detail to prepare an intelligent defense.

The notices should be served personally or at the employee’s last known address, with reliable proof of service. Electronic delivery may be used as an additional method, but relying only on an unverified email or message can create a dispute about actual notice.

The requirements appear in DOLE Department Order No. 147-15 and are explained in King of Kings Transport, Inc. v. Mamac, G.R. No. 166208, June 29, 2007.

4. Give a meaningful opportunity to answer

The five-day period is intended to allow the employee to study the accusation, consult a lawyer or union officer, gather records, and prepare a defense. Management should consider a reasonable extension when records are voluminous, the employee is ill, material documents have not been made available, or another legitimate circumstance prevents a complete response.

The employee may submit:

A written explanation;
Affidavits or witness statements;
Relevant work records;
Corrections to the employer’s timeline or computations;
Evidence of authorization, established practice, system error, or lack of access;
A request for material records needed for the defense; and
A written request for a hearing or conference.

Due process does not necessarily require delivery of the employer’s entire confidential investigation file. The notice must, however, disclose the material accusations and circumstances sufficiently, and the employee must have a genuine opportunity to rebut the evidence relied upon. Relevant records may be provided with lawful redactions to protect unrelated personal or confidential information.

5. Hold a hearing when required

A formal hearing is mandatory when:

The employee requests it in writing;
Substantial evidentiary disputes exist;
Company rules, established practice, or a collective bargaining agreement require it; or
Similar circumstances make a conference necessary for a fair resolution.

Otherwise, a complete written response may satisfy the opportunity-to-be-heard requirement. A private administrative conference is not a courtroom trial, and technical rules of evidence do not strictly apply. The employee must nevertheless be allowed to explain, present supporting evidence, and respond to the employer’s material evidence. The employee may seek assistance from a representative, union officer, or counsel.

See Perez v. Philippine Telegraph and Telephone Company, G.R. No. 152048, April 7, 2009.

6. Give notice of any new charge

If the investigation uncovers a materially different transaction, date, falsified document, or legal ground, the employer should issue a supplemental notice and give another meaningful opportunity to respond. A dismissal should not rest on incidents first introduced in the termination letter.

7. Decide only after evaluating both sides

The decision-maker should separately determine:

Whether the act occurred;
Whether the employee committed or knowingly participated in it;
Whether wrongful intent was established;
Whether the charged company rule was communicated and actually violated;
Whether the facts satisfy the particular just cause invoked;
Whether similar cases were treated consistently; and
Whether dismissal is proportionate to the offense.

There must be reasonable proportionality between the violation and the penalty. Relevant circumstances may include the employee’s role, the nature and effect of the act, benefit or attempted concealment, prior record, length of service, and the employer’s disciplinary rules. These factors do not excuse proven serious fraud, but they may matter when the act is minor, ambiguous, or adequately addressed by a lesser penalty.

8. Serve a reasoned second written notice

If dismissal is justified, the employer must issue a written notice stating that:

The employee’s explanation and the surrounding circumstances were considered;
The factual findings established the charge;
The identified conduct constitutes the stated just cause and policy violation;
Dismissal has been decided; and
The effective date of termination.

The second notice should match the charges in the first notice. A conclusory statement that management “lost confidence” is risky when it does not explain the proven act and its connection to the employee’s duties.

If the evidence does not support dismissal, the employee should be cleared or given only the proportionate corrective measure allowed by law and company policy.

Preventive suspension is limited

Preventive suspension is not supposed to be an advance penalty. It may be used only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or coworkers.

Where the concern is possible record tampering or further loss, the employer should first consider less disruptive measures, such as temporarily removing system access, changing approval authority, transferring custody of records, or assigning non-sensitive work.

When justified:

An unpaid preventive suspension may not exceed 30 days for the offense under investigation.
After 30 days, the employee must be reinstated to the former or a substantially equivalent position, or the extension must be with wages and benefits.
Wages paid during a lawful extension are not reimbursable even if the employee is later dismissed.
An unjustified preventive suspension may result in liability for the salary lost during the suspension.
A genuinely separate, newly discovered offense may support a separate suspension period, but the employer should not relabel the same charge merely to evade the 30-day limit.

These rules are discussed in Smart Communications, Inc. v. Solidum, G.R. Nos. 197763 and 197836, December 7, 2015.

There is no single statutory deadline requiring every private investigation to be completed within a fixed number of days. The handbook, employment contract, or collective bargaining agreement may impose one. In all cases, the employer should act promptly, particularly when preventive suspension is involved.

Practical steps for an employee who receives a notice

Record the exact date and time the notice was received. Keep the envelope, email headers, acknowledgment, and attachments.
Read the charges carefully. Identify missing dates, transactions, documents, or rules.
Ask promptly and in writing for material records needed to answer.
Request a reasonable extension before the deadline if a complete response is impossible.
If facts are seriously disputed, request a conference or hearing in writing.
Answer each allegation directly. Separate admitted facts from disputed assumptions.
Attach supporting records and identify witnesses with first-hand knowledge.
Preserve evidence lawfully. Do not delete, alter, backdate, or fabricate anything, and do not take unrelated confidential company data.
Check the handbook, employment contract, and collective bargaining agreement for additional rights, appeal procedures, representation, or disciplinary deadlines.
Keep proof of every submission. Obtain a receiving copy or reliable delivery confirmation.

Signing that a notice was received does not necessarily mean admitting the charge. If appropriate, the employee may write “received only” with the date and time. Do not sign a confession, resignation, quitclaim, blank document, repayment agreement, or salary-deduction authorization without understanding its effect.

Common mistakes

Mistakes by employers

Deciding on dismissal before asking for an explanation;
Issuing a vague notice with no specific transactions or dates;
Giving fewer than five calendar days without a valid waiver or adequate opportunity;
Treating an audit shortage as automatic proof of the employee’s guilt;
Relying on edited screenshots, hearsay, or unsigned summaries without corroboration;
Refusing a written hearing request despite major factual disputes;
Using evidence or charges never stated in the first notice;
Keeping the employee on unpaid preventive suspension beyond 30 days;
Invoking loss of trust for a worker who does not hold a position of trust;
Publicly calling the employee a thief or criminal before lawful adjudication; or
Searching personal accounts or collecting excessive personal data without a lawful and proportionate basis.

Mistakes by employees

Ignoring the notice because it appears vague or unfair;
Responding only orally and keeping no proof;
Making broad denials without addressing transactions or documents;
Missing the deadline without requesting an extension;
Deleting messages or changing records after learning of the investigation;
Taking confidential company files unrelated to the defense;
Secretly recording private conversations without first checking the legal risks; or
Resigning under pressure without documenting what happened or obtaining advice.

An internal case is separate from a criminal case

An internal finding determines employment consequences; it does not convict anyone of a crime. The employer does not necessarily need to obtain a criminal conviction before imposing discipline because labor cases use the substantial-evidence standard. Conversely, an internal finding does not guarantee that a prosecutor or court will find probable cause or guilt beyond reasonable doubt.

A possible criminal complaint, civil recovery action, insurance claim, or regulatory report should be assessed separately. Repayment or an offer to settle is not automatically an admission of fraud, and the investigation does not by itself authorize unrestricted salary deductions or withholding of amounts otherwise due.

Consequences of getting the process wrong

If no just cause is proven, the dismissal is illegal even if the employer issued two notices. Depending on the case, the employee may be entitled to reinstatement without loss of seniority and full backwages, or separation pay in lieu of reinstatement when reinstatement is no longer feasible.

If a valid just cause is proven but procedural due process was not observed, the dismissal generally remains valid, but the employer may be ordered to pay nominal damages. The prevailing rule for a just-cause dismissal is the ₱30,000 award applied in Agabon v. NLRC, G.R. No. 158693, November 17, 2004.

Additional damages may be awarded when the dismissal was attended by bad faith, fraud, oppression, or a wanton or malevolent manner, but such damages require their own factual basis.

When help is urgent

Seek prompt advice from a union representative, labor lawyer, or qualified legal-aid provider if:

The response deadline is about to expire and important records are unavailable;
The employee is being forced to resign, confess, or sign a quitclaim;
Preventive suspension exceeds 30 days without reinstatement or pay;
Evidence is being destroyed or altered;
The case involves several employees, senior officers, large losses, or regulated records;
A criminal complaint, subpoena, search, or government investigation has begun;
Personal devices, accounts, or sensitive personal information are being demanded;
Dismissal has already taken effect; or
A collective bargaining agreement may require grievance machinery or voluntary arbitration.

For most labor disputes, a worker or employer may file a Request for Assistance under the Single Entry Approach. SEnA currently provides a 30-calendar-day mandatory conciliation-mediation process under DOLE Department Order No. 249, Series of 2025. Requests may be filed through the official DOLE Assistance for Request Management System or onsite at participating DOLE, NCMB, and NLRC offices.

An illegal-dismissal claim generally prescribes in four years from dismissal. Separate money claims arising from employment generally prescribe in three years from accrual. Because prescription and the effect of prior filings can be fact-sensitive, do not wait for the deadline.

Frequently asked questions

Can an employee be dismissed for one falsified record?

Possibly. A first offense may justify dismissal when the falsification, intent, work connection, employee’s role, and resulting breach are sufficiently serious. But there is no automatic rule that every inaccurate entry warrants dismissal. The employer must prove the employee’s knowing participation and a just cause proportionate to the facts.

Is an audit report enough to dismiss someone?

Not necessarily. An audit may prove a discrepancy or loss, but the employer must still connect the employee to the wrongful act through substantial evidence and address possible innocent explanations or control failures.

Must the employer give the employee every document in the investigation file?

Not automatically. The employee must receive specific charges and a meaningful opportunity to rebut the material evidence. Relevant records necessary for the defense should be considered for disclosure, subject to lawful redaction and protection of unrelated personal or confidential information.

Can the employer dismiss an employee who refuses to answer?

The employer may decide using the available evidence if the employee received a proper notice and a genuine opportunity to respond but declined or failed to do so. Silence does not relieve the employer of its burden to prove a valid cause.

Is a lawyer required during the company investigation?

No. An employee may prepare a response personally, with a union representative, or with counsel. Legal assistance is especially useful when dismissal, significant financial liability, or criminal exposure is possible.

Does filing a criminal case automatically justify dismissal?

No. Filing a complaint proves only that an allegation was made. The employer must independently establish a Labor Code ground through substantial evidence and observe the required termination procedure.

Can the employee challenge the dismissal internally and still go to DOLE or the NLRC?

Generally, yes, subject to the company rules, collective bargaining agreement, SEnA requirements, and applicable deadlines. Preserve the internal appeal and all proof of filing. Unionized employees should check whether the CBA requires grievance machinery or voluntary arbitration.

Official references

This article provides general legal information, not advice for a specific investigation or case. Employment status, company rules, a CBA, the precise notices, and the available evidence can change the result. Official sources and current procedures were checked as of August 4, 2026.