Employee Theft and Job Abandonment in the Philippines: Proper Disciplinary Due Process

Updated for the Labor Code of the Philippines, as amended, and key DOLE rules and jurisprudence. This is general information, not legal advice.

I. Why this matters

Security of tenure is guaranteed by the Constitution and the Labor Code. Even when an employee commits a grave infraction like theft or abandons work, dismissal is valid only if (1) there is a just cause and (2) the employer strictly observes procedural due process. Both elements must be present; a failure on either front can result in an illegal dismissal finding, back wages, damages, and other liabilities.

II. Legal bases at a glance

A. Substantive “just causes” (Labor Code, Art. 297 [formerly 282])

Serious misconduct or willful disobedience of lawful orders.
Gross and habitual neglect of duties.
Fraud or willful breach of trust (loss of trust and confidence).
Commission of a crime or offense by the employee against the employer, employer’s family, or authorized representatives.
Other analogous causes.

Employee theft typically falls under:

Serious misconduct;
Fraud or willful breach of trust; and/or
Commission of a crime against the employer.

Job abandonment is a recognized just cause in jurisprudence, usually treated as:

A form of gross neglect of duty or an analogous cause.

B. Procedural due process (the “twin-notice and hearing” rule)

Notice to Explain (NTE): A detailed written charge informing the employee of the specific acts/omissions, company rules/law violated, and requiring a written explanation within a reasonable period (commonly five [5] calendar days under DOLE guidance).
Opportunity to be heard: An administrative conference/hearing where the employee may respond, present evidence, and be assisted by counsel or a representative.
Notice of Decision (NOD): A reasoned written decision stating the facts, the rule/law violated, the evaluation of defenses, and the penalty imposed.

Failure to observe these minimum steps can render a dismissal defective—even if the cause is otherwise valid.

III. Employee theft

A. What constitutes “theft” in employment

Unauthorized taking, possession, use, or concealment of company property, supplies, funds, or confidential/intangible assets (e.g., data, trade secrets), with intent to gain or to prejudice the employer.
May include pilferage, inventory manipulation, falsification of receipts, padding reimbursements, diverting sales, coupon/points abuse, unauthorized discounts, time theft (via fraud), or data exfiltration.

Note: An acquittal in a criminal case or the absence of a criminal complaint does not bar dismissal. Administrative liability requires only substantial evidence, not proof beyond reasonable doubt.

B. Loss of trust and confidence (LOTC)

Dismissal for LOTC is valid when:

The employee holds a position of trust (managerial; or fiduciary rank-and-file like cashiers, storekeepers, auditors, collectors), and
There are clearly established facts showing a willful breach of trust, work-related, and not based on mere suspicion.

C. Evidence typically used

CCTV footage; POS/audit trails; inventory variance and shrinkage reports; access logs (IT, door badges); email/IM records (in compliance with data privacy rules); forensic imaging for data cases; witness statements; admissions/confessions (must be voluntary, preferably written and witnessed); chain-of-custody records for seized items.

D. Preventive suspension

Allowed only if the employee’s continued presence poses a serious and imminent threat to life or property or to the integrity of evidence.
Maximum 30 calendar days. If investigation needs more time, either (a) reinstate the employee to a non-sensitive post or (b) extend with pay beyond 30 days.
Preventive suspension is not a penalty; it’s a precaution while investigating.

E. Penalty calibration

Dismissal is generally proportionate for theft or fraud, even for a first offense, given the gravity and breach of trust.
Lesser penalties (e.g., suspension) are rare and typically reserved for de minimis situations with strong mitigating factors.

IV. Job abandonment

A. Legal test (two indispensable elements)

Failure to report for work or absence without valid or justifiable reason; and
A clear intention to sever the employment relationship (animus deserendi), shown by overt acts.

B. What does not automatically prove abandonment

Mere absence or AWOL entries without proof of intent to sever.
Failure to file a leave form, by itself.
An employee’s illegal dismissal complaint or prompt return-to-work request typically negates intent to abandon.

C. Employer’s burden of proof

The employer must prove both prolonged unjustified absence and intent to sever (e.g., ignoring return-to-work directives, refusal to receive notices, explicit statements of quitting without notice).

D. Due process specifics for abandonment

Send the NTE and, when warranted, a directive to report back to the employee’s last known address (and official email, if applicable).
If no response, proceed with the hearing in absentia on the scheduled date/time, documenting attempts to notify.
Issue a reasoned NOD if dismissal is warranted.

V. The due-process workflow (step-by-step)

Immediate containment and documentation
- For theft: secure assets, preserve CCTV/logs, segregate access, and prepare an incident report.
- For abandonment: log dates of absence, missed shifts, call attempts, and any messages.
Issue the Notice to Explain (NTE)
- State the charge clearly: who, what, when, where, how; cite policy provisions and the just cause(s).
- Attach evidence or specify how to inspect it.
- Give at least 5 calendar days to submit a written explanation.
Administrative conference/hearing
- Invite the employee; allow representation.
- Present evidence; allow cross-questions.
- Record minutes; have attendees sign.
Evaluate using “substantial evidence”
- Is there reliable and relevant evidence that a reasonable mind might accept?
- Assess proportionality of penalty and consistency with past cases (avoid discrimination).
Issue the Notice of Decision (NOD)
- Recite facts, evidence weighed, the policy/law violated, the standard applied, and the penalty.
- For dismissal: specify it is for just cause under Art. 297; state effective date.
- Serve to the employee’s last known address and official channels; keep proof of service.
Post-decision actions
- Process final pay in line with DOLE guidance (commonly within 30 days from separation).
- Issue Certificate of Employment upon request (commonly within 3 working days).
- Settle government reporting requirements (SSS, PhilHealth, Pag-IBIG) and update 2316 if applicable.
- Maintain a complete case file (NTE, reply, minutes, evidence, NOD, proofs of service).

VI. Special topics & practical pitfalls

A. Parallel criminal action for theft

Independent from administrative proceedings. You may file a criminal complaint (e.g., Qualified Theft/Estafa) while or after the admin case proceeds.
No double jeopardy: different forums, different standards of proof.

B. Data privacy and surveillance

Ensure CCTV, monitoring, and device searches follow Data Privacy Act principles: transparency, legitimate purpose, proportionality.
Provide policies and consent in handbooks and onboarding documents.
Limit access to evidence on a need-to-know basis; keep audit trails.

C. Confessions and interviews

Avoid coercion; allow the employee to read, review, and sign any statement voluntarily, with a witness.
If counsel is requested, accommodate within a reasonable time.

D. Consistency and non-discrimination

Apply rules uniformly. Disparate penalties for similar theft/abandonment cases can undermine LOTC and fuel claims of bad faith.

E. Preventive suspension misuse

Do not impose it as a default. Document the imminent threat and why lesser measures (e.g., reassignment) won’t suffice.
Track the 30-day cap meticulously.

F. Resignations vs. abandonment

A valid resignation must be clear, voluntary, and unconditional; alleged resignations obtained under pressure are suspect.
If an employee tenders resignation after charges, you may accept it, but consider continuing the fact-finding for record integrity.

G. Probationary, fixed-term, and project employees

Same due process for just-cause termination.
For probationary employees, apart from theft/abandonment, ensure the standards were clearly communicated at hiring.

H. Separation pay and damages

For just-cause dismissals like theft or abandonment, no separation pay is ordinarily due.
Nominal damages may be awarded by courts if due process was defective despite a valid cause (the amounts vary with jurisprudence).

I. Prescription periods

Money claims: generally 3 years from accrual.
Illegal dismissal actions: generally 4 years (treated as an injury to rights).
Administrative discipline is not barred by the pendency of criminal cases or the absence of a conviction.

VII. Employer checklists

A. Theft case checklist

Incident report with timeline and persons involved
Evidence preserved (CCTV, logs, inventory/audit, emails, devices)
Access controls revised to prevent spoliation
NTE with detailed facts and rule citations; 5 days to respond
Hearing notice; conference held/waived; minutes on file
Written evaluation applying substantial evidence standard
NOD served to last known address and official channels
Preventive suspension (if any) justified and within rules
Final pay/COE processed; government reporting updated
Complete case file archived

B. Abandonment case checklist

Absence log and communications record (calls/emails/texts/letters)
Return-to-work directive(s) sent to last known address
NTE specifying dates of absence and rule violated; 5 days to reply
Hearing notice; conference held in absentia if no appearance
Evidence of intent to sever (ignored directives, explicit messages)
NOD with reasons and effective date; proof of service
Final pay/COE and reporting requirements complied with

VIII. Model templates (short forms)

Notice to Explain (NTE) – Theft (Sample) Date: ____ To: ____ (Position/Dept) Re: Notice to Explain – Alleged Theft / Fraud / Breach of Trust On [date/time], at [location], you allegedly [describe act], contrary to [Policy § / Handbook § / Code of Conduct] and constituting [serious misconduct / fraud / willful breach of trust / commission of an offense] under Article 297 of the Labor Code. Attached are [list evidence]. You are required to submit a written explanation within five (5) calendar days from receipt of this Notice and to attend an administrative conference on [date/time/place or video link]. You may be assisted by counsel or a representative. Pending investigation, you are [placed on preventive suspension for up to 30 days / reassigned to … / not placed on preventive suspension]. Failure to submit an explanation and/or attend the conference will be deemed a waiver. Signed: ____

Notice to Explain (NTE) – Abandonment (Sample) Date: ____ To: ____ Re: Notice to Explain – Absence Without Leave / Abandonment Records show you were absent without approved leave from [dates]. Please explain in writing within five (5) calendar days why you should not be sanctioned for [gross neglect / abandonment] and report back to work on or before [date/time]. An administrative conference is set on [date/time/place or link]. Non-appearance will be deemed a waiver. Signed: ____

Notice of Decision (NOD) – Dismissal (Sample) Date: ____ To: ____ Re: Notice of Decision – Dismissal for Just Cause After evaluating your written explanation dated [date], the records, and the proceedings on [date(s)], we find you [state findings of fact], violating [policy/law] amounting to [serious misconduct / fraud / breach of trust / gross neglect / abandonment] under Article 297 of the Labor Code. Accordingly, your employment is terminated effective [date]. You may claim your final pay within [timeline]. Upon request, we will issue your Certificate of Employment. Signed: ____

IX. Frequently asked practical questions

1) Do we need a criminal complaint to dismiss for theft? No. Administrative dismissal can proceed independently on substantial evidence.

2) The employee returned the item—does that cure the offense? No. Intent and breach of trust remain; return may be a mitigating factor but rarely negates liability.

3) The employee ignored the NTE—can we decide without a hearing? If the employee waives by non-response or non-appearance despite proper notice, proceed and document the waiver and your evaluation.

4) How long can the investigation take? Act promptly. If preventive suspension is used, respect the 30-day cap or pay beyond it/reassign.

5) Can abandonment be found after a short absence? Abandonment hinges on intent to sever, not a fixed number of days. Longer AWOL strengthens the inference, but employers must still prove animus deserendi.

6) Is separation pay due for theft or abandonment? Ordinarily no for just-cause dismissal. Courts may award nominal damages for procedural lapses even where the cause is valid.

X. Takeaways for compliant discipline

Write it, serve it, prove it. Clear notices, proper service to last known address, and complete records win cases.
Proportionate penalty, consistent practice. Similar offenses should attract similar sanctions.
Protect evidence and privacy. Secure logs and devices lawfully; preserve chain-of-custody.
Move fast, but fair. Timely investigations and decisions reduce risk of claims and evidence loss.
Train line managers. Many illegal dismissal cases are lost on procedure, not merits.

Final note

Facts are king. Tailor the steps above to your policies, contracts, and the specific evidence in your case. When in doubt—especially for high-risk dismissals involving alleged theft—seek counsel to stress-test your notices, hearing, and decision before you issue them.