Quick answer

A Philippine private-sector employer may investigate suspected employee fraud or falsified records and may impose dismissal if the proven conduct constitutes a just cause under Article 297 of the Labor Code—such as fraud, a willful breach of trust, serious misconduct, or another applicable ground.

Suspicion, an audit discrepancy, or the employer’s loss of confidence is not enough by itself. Before dismissal, the employer must establish a lawful ground through substantial evidence and observe procedural due process:

Give the employee a detailed first written notice specifying the acts or omissions charged and the rule or legal ground involved.
Allow at least five calendar days from receipt to prepare and submit a defense.
Provide a meaningful opportunity to be heard, including a conference or hearing when legally required.
Consider the employee’s explanation and all relevant evidence fairly.
Give a second written notice stating the findings and the reason for the final decision.

The investigation and the disciplinary decision are separate questions. Even strong evidence does not excuse a defective process, while perfect procedure cannot cure a dismissal unsupported by a valid cause.

What must the employer prove?

Article 297 of the Labor Code permits termination for, among other just causes:

Serious misconduct connected with the employee’s work;
Fraud or willful breach of the trust placed in the employee;
Commission of a crime or offense against the employer, an immediate family member, or an authorized representative; and
Causes analogous to those expressly listed.

Falsifying time records, receipts, reimbursement claims, sales reports, inventory documents, payroll data, medical certificates, customer records, credentials, or electronic approvals may support discipline. Whether it justifies dismissal depends on the employee’s intent, duties, the nature and importance of the record, the applicable company rule, and the evidence proving the employee’s participation.

For fraud or willful breach of trust, the employer generally must show:

An intentional act, omission, or concealment—not merely carelessness or an innocent mistake;
A breach of a legal duty, trust, or confidence properly placed in the employee;
Conduct directed against the employer or its authorized representative;
A connection between the conduct and the employee’s work; and
A genuine, fact-based reason to conclude that continued employment is no longer compatible with the position.

The Supreme Court has emphasized that a willful breach is committed intentionally, knowingly, and purposely, without justifiable excuse. Loss of confidence cannot rest on whims, unsupported accusations, or speculation. See San Miguel Corporation v. Gomez.

The employee’s position matters

Loss of trust and confidence ordinarily applies to:

Managerial employees who exercise substantial management authority; and
Fiduciary rank-and-file employees who routinely handle significant money, property, sensitive records, or similarly delicate matters, such as cashiers, auditors, and property custodians.

A job title is not controlling. The actual functions, access, authority, and accountability shown by the employment documents and workplace practice matter.

For a fiduciary rank-and-file employee, the employer must prove involvement in the alleged misconduct; uncorroborated accusations do not suffice. For a managerial employee, the evidentiary assessment may be less exacting, but there must still be a real, reasonable, and good-faith basis for believing that the employee breached the employer’s trust. Mere suspicion remains inadequate.

If the employee does not occupy a position of trust, the same falsification may possibly fall under serious misconduct or another just cause—but the employer must identify and prove the correct ground instead of automatically labeling every irregularity a “loss of trust.”

A fair investigation process

1. Secure the records without deciding guilt in advance

The employer should promptly preserve relevant records while keeping the inquiry appropriately confidential. Depending on the allegation, these may include:

Original forms, receipts, vouchers, reports, and approval documents;
Audit trails, system logs, access records, and document-version histories;
Relevant emails and authorized workplace communications;
CCTV footage before routine deletion;
Attendance, payroll, inventory, accounting, or transaction records;
Written policies, acknowledgment forms, job descriptions, and delegation records;
Specimen signatures or verified records for comparison;
Witness statements based on personal knowledge; and
Records showing who created, changed, approved, transmitted, or benefited from the questioned entry.

Investigators should preserve original files when possible, work from copies, record who collected each item, and document any extraction or transfer of electronic evidence. A screenshot without its source, date, account information, or surrounding context may be open to challenge.

Records should not be altered, backdated, selectively deleted, or reconstructed after the dispute begins. The employer should also avoid unauthorized access to an employee’s private device, personal account, or private communications. Collection and use of personal information must have a lawful basis and remain necessary and proportionate under the Data Privacy Act of 2012.

2. Conduct a neutral preliminary assessment

Before accusing a particular employee, check whether the discrepancy could have resulted from:

A system or encoding error;
Confusing or inconsistent procedures;
Shared credentials or uncontrolled access;
An authorized correction or override;
Another person’s act;
A missing or incomplete source document; or
Negligence rather than intentional deception.

An investigation should test both incriminating and exculpatory explanations. The person who reported the allegation should not automatically be treated as conclusive, particularly if that person participated in the transaction or has a conflict of interest.

3. Issue a specific notice to explain

The first notice should be in writing and served through a method that permits proof of receipt. It should state:

The particular acts or omissions charged;
The relevant dates, transactions, records, amounts, locations, and persons involved, if known;
The company policy and Labor Code ground that may apply;
Why the alleged conduct may warrant dismissal;
The deadline and method for submitting a written explanation;
How the employee may inspect or obtain the evidence reasonably needed to respond; and
Whether and how the employee may request a conference or hearing.

A notice saying only “fraud,” “dishonesty,” “falsification,” or “loss of trust” is ordinarily too vague. The employee must be able to understand the accusation and prepare a meaningful defense.

The Supreme Court interprets a “reasonable opportunity” to answer as at least five calendar days from receipt of the notice. This period allows the employee to study the charge, consult a union officer or lawyer, gather evidence, and choose a defense. See King of Kings Transport, Inc. v. Mamac and DOLE Department Order No. 147-15.

A shorter deadline is risky even if the allegation appears simple. A collective bargaining agreement, employment contract, or company policy may provide a longer period or additional safeguards, which the employer must also observe.

4. Give a meaningful opportunity to respond

The employee should answer fact by fact and attach supporting records where available. A response may:

Admit or deny making the questioned entry;
Explain the workflow and who had access;
Identify an authorization, correction, or system issue;
Distinguish an inadvertent error from an intentional falsehood;
Challenge the authenticity, completeness, or context of the employer’s evidence;
Identify witnesses or request relevant records;
Raise inconsistent enforcement, retaliation, discrimination, or conflict of interest; and
Request a conference or additional reasonable time, with an explanation why it is needed.

A formal trial-type hearing is not required in every case. Written explanations may satisfy the opportunity-to-be-heard requirement. A conference or hearing should, however, be held when the employee requests it in writing, substantial factual disputes require clarification, company rules or a collective bargaining agreement require it, or comparable circumstances make a conference necessary.

The employer need not apply courtroom evidence rules mechanically, but the process must remain fair. Evidence should be disclosed sufficiently for the employee to understand and answer the material case. Secret evidence that the employee had no meaningful chance to address creates serious due-process risk.

If the employee refuses to receive the notice, fails to answer, or does not attend after proper notice, document the refusal or nonappearance. The employer may decide on the available evidence, but the employee’s silence does not itself prove fraud.

5. Evaluate the evidence and the proper penalty

The final decision should not merely repeat the accusation. It should determine:

Whether the questioned record is false or materially misleading;
Whether the employee made, caused, used, approved, or knowingly concealed it;
Whether the conduct was intentional;
Whether it was connected with work;
Whether the employee occupied a position of trust;
Whether the explanation is supported or contradicted by the records;
Whether the applicable rule was communicated and consistently enforced; and
Whether dismissal is proportionate to the established offense.

An actual financial loss or criminal conviction is not always required for a valid labor dismissal. Conversely, a discrepancy or the filing of a criminal complaint does not automatically prove a just cause.

The employer carries the burden of proving the lawful basis for dismissal through substantial evidence—relevant evidence that a reasonable mind might accept as adequate. Mere allegations are not evidence.

6. Issue a reasoned second notice

If dismissal is imposed, the second written notice should:

Identify the charge or charges found established;
Summarize the material findings and evidence considered;
Address the employee’s important defenses;
State the company rule and legal ground applied;
Explain why the conduct warrants the selected penalty; and
State the effective date of termination.

The decision should rely only on charges the employee had a fair chance to answer. Introducing a new accusation for the first time in the termination notice defeats the purpose of the first notice.

Preventive suspension during the investigation

Preventive suspension is not an automatic response to a fraud allegation and is not supposed to be a punishment. It may be used when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers—for example, where the employee retains access to funds, records, systems, or evidence that could be altered or lost.

A preventive suspension for one offense may not exceed 30 days. If the investigation cannot be completed within that period, the employer must generally reinstate the employee or extend the suspension while paying wages and benefits during the extension. The precise treatment should be checked against the applicable rules, contract, and circumstances.

Less restrictive safeguards may sometimes be sufficient, such as temporarily changing access rights, preserving system logs, reassigning approval authority, or transferring the employee away from the affected records. The Supreme Court discusses the purpose and limits of preventive suspension in Davao Central Warehouse Club, Inc. v. Salarda.

Administrative discipline and criminal liability are separate

An internal employment investigation is distinct from a criminal case for falsification, estafa, qualified theft, cybercrime, or another offense.

The outcomes need not be identical because the proceedings have different purposes and standards of proof. An employer need not await a criminal conviction before deciding an administrative employment case. Likewise, dismissal from work does not establish criminal guilt.

Employers should not use threats of arrest or prosecution to force a resignation, repayment, confession, or waiver. Employees asked to sign an admission, settlement, resignation, or undertaking with possible criminal consequences should obtain independent legal advice before signing.

Evidence both sides should preserve

For the employer

Preserve the complete record, including evidence that may favor the employee:

Investigation authority and scope;
Original and questioned documents;
Audit methodology and source data;
System-access and change logs;
Witness interviews and signed statements;
Notices and proof of service;
The employee’s explanations and attachments;
Conference minutes or recordings made with proper authority;
Policies effective when the incident occurred;
Comparable disciplinary cases, where relevant to consistency; and
The written analysis supporting the decision.

For the employee

Keep lawful copies of:

The notice to explain and all attachments;
Proof of the date and manner of receipt;
The written response and proof of submission;
Employment contract, handbook, job description, and relevant policies;
Emails, approvals, instructions, and transaction records already lawfully accessible;
Names of witnesses with personal knowledge;
Notices of suspension or termination;
Payslips and employment records; and
Notes of meetings, including dates, attendees, and what was said.

Do not delete files, alter records, coach witnesses, take confidential materials unrelated to the defense, or access systems after authority has been withdrawn.

Common mistakes

Employers commonly create legal exposure by:

Treating an accusation or audit exception as proof;
Sending a vague notice without dates, transactions, or specific acts;
Allowing fewer than five calendar days to answer;
Withholding the substance of the evidence needed for a response;
Using a hearing only to confirm a decision already made;
Relying on a charge not included in the first notice;
Imposing preventive suspension without a serious and imminent threat;
Extending unpaid preventive suspension beyond the lawful period;
Failing to distinguish intentional fraud from error or negligence;
Applying “loss of trust” to an employee without trust-related functions;
Ignoring a collective bargaining agreement or company procedure; or
Pressuring the employee to resign instead of completing due process.

Employees commonly weaken their position by:

Ignoring the notice or answering only with a general denial;
Missing the deadline without requesting an extension;
Signing a confession, resignation, or waiver without understanding it;
Altering or deleting electronic records;
Taking company files indiscriminately;
Posting confidential accusations on social media; or
Failing to preserve proof of receipt and submission.

Consequences of an unlawful or procedurally defective dismissal

If the employer fails to prove a just cause, the dismissal may be declared illegal, potentially resulting in reinstatement and full backwages, subject to the facts and the final adjudication.

If a valid just cause is proven but statutory procedural due process was not observed, the dismissal may remain valid, but the employer may be ordered to pay nominal damages. Under prevailing Supreme Court doctrine for just-cause dismissals, the usual award has been ₱30,000, although the final relief remains for the labor tribunal or court to determine. See Agabon v. NLRC.

Contractual remedies may differ if the employer also violated a collective bargaining agreement, employment contract, or its own binding disciplinary rules.

When legal help is urgent

Seek advice promptly if:

The response deadline is approaching;
Preventive suspension may exceed 30 days;
The employee is being asked to confess, resign, reimburse money, or waive claims;
Police, prosecutors, or the NBI have become involved;
Devices, private accounts, or sensitive personal data were searched or copied;
The accusation may involve several employees or senior management;
The case may involve retaliation for union activity, whistleblowing, discrimination, or a protected complaint;
Important digital evidence may soon be deleted;
A termination notice has already been issued; or
The employer is considering filing a criminal complaint or publicly identifying the employee.

An aggrieved employee or employer may seek conciliation assistance through DOLE’s Single Entry Approach. Requests for Assistance may be filed onsite at participating labor offices or online through the official DOLE Assistance Request Management System.

Mandatory conciliation-mediation generally precedes an NLRC complaint, subject to statutory exceptions. An illegal-dismissal claim generally prescribes in four years from accrual, while many separate money claims prescribe in three years. Do not wait for the deadline: evidence, witnesses, and practical remedies may become harder to secure much earlier. The current filing framework appears in the 2025 NLRC Rules of Procedure.

Frequently asked questions

Can an employee be dismissed for one falsified record?

Possibly. A single deliberate falsification may be sufficiently serious, particularly when it concerns money, property, regulatory compliance, safety, qualifications, or a position of trust. But dismissal is not automatic. Intent, materiality, work connection, job duties, applicable rules, and proportionality must be established from the evidence.

Is an admission necessary?

No. Fraud may be proved through documents, audit trails, credible statements, and circumstantial evidence. The combined evidence must still meet the substantial-evidence standard and reasonably identify the employee’s participation and intent.

Does an employee have a right to a lawyer during the company investigation?

The Labor Code’s dismissal procedure does not turn every company investigation into a courtroom proceeding. An employee should nevertheless be given enough time to consult a lawyer or union representative. A collective bargaining agreement or company rule may provide specific representation rights.

Must the employer disclose every internal document?

Not necessarily every document. However, the first notice and available supporting information must be sufficient to let the employee understand and meaningfully answer the material allegations. Confidentiality does not justify concealing the substance of the case.

Can the employer suspend system access without suspending employment?

Generally, reasonable interim access controls may be appropriate to protect records or property, provided they are not used as a disguised dismissal, punitive indefinite suspension, or discriminatory measure. Pay, duties, duration, and the employee’s ability to participate in the investigation should be considered.

What if several people used the same account or password?

Shared access weakens an inference based only on account ownership. The investigation should examine device logs, timestamps, approval paths, physical access, instructions, and corroborating evidence rather than assume that the named account holder made the entry.

Does repayment erase the offense?

Not automatically. Repayment may affect the factual assessment or penalty, but it does not necessarily remove an intentional breach of trust. Likewise, demanding repayment does not relieve the employer of its duty to prove the charge and observe due process.

Can an employee be cleared internally but still face a criminal case?

Yes. The proceedings are legally distinct. The reverse is also possible: termination may be upheld on substantial evidence even without a criminal conviction. Anyone facing possible criminal exposure should obtain counsel.

Official legal references

This article provides general legal information, not legal advice, and primarily addresses private-sector employment. Government personnel are governed by separate civil-service statutes and disciplinary rules. The proper outcome depends on the employee’s duties, the applicable policy or collective bargaining agreement, the notices issued, and the complete evidence. Sources and procedures were checked as of August 27, 2026.