A practitioner’s guide for employers, HR, investigators, and counsel

I. Why evidence matters (and the two tracks you may take)

Alleged employee theft engages two distinct legal tracks, each with its own evidentiary threshold:

Administrative/Labor – to discipline or dismiss an employee for just cause. The standard is substantial evidence: relevant evidence that a reasonable mind might accept as adequate.
Criminal – to prosecute theft/qualified theft/estafa under the Revised Penal Code. The standard is proof beyond reasonable doubt.

You may pursue one or both tracks, but do not conflate the standards. A dismissal can be valid even if the criminal case is acquitted (and vice-versa), provided the labor standard and due process were met.

II. Legal anchors (what you must prove)

A. Administrative just causes commonly invoked for theft

Serious Misconduct
Fraud or Willful Breach of Trust (a.k.a. Loss of Trust & Confidence)
Commission of a crime or offense against the employer, his family, or representatives
Gross and habitual neglect (when shortages are systemic and tied to the employee’s duties)

For managerial employees, any willful breach of the trust reposed in them—based on clearly established facts—may suffice. For rank-and-file, you must link the act to the employee’s assigned functions and show actual involvement; mere suspicion is not enough.

B. Criminal law elements (quick orientation)

Theft (Art. 308): Taking personal property of another, without consent, with intent to gain, and asportation (movement).
Qualified Theft (Art. 310): Theft with grave abuse of confidence (e.g., cashiers, warehouse custodians).
Estafa (Art. 315): Defraudation through abuse of confidence or deceit, typically where the property was initially received with consent (e.g., cash advances, entrusted property) but misappropriated.

III. Burden and quantum of proof

In labor cases, the employer bears the burden to prove just cause and compliance with due process.
Substantial evidence is not a hunch; it requires documents, records, testimony, or reliable electronic proof that logically connect the employee to the specific loss.

IV. The evidence map (what to gather and how to make it stick)

1) Physical and documentary evidence

Inventory and reconciliation reports: pre-/post-shift counts, variance sheets, shrinkage reports, stock cards, bin cards.
Custody documents: gate passes, pullout forms, delivery receipts, waybills, petty cash vouchers.
Transaction data: POS Z-readings, voids/returns logs, discounts/override reports, cash declaration slips, till audits, shortage reports.
Access/entry records: door swipes, turnstile logs, vehicle stickers and logbooks, visitor passes.
Policies and acknowledgments: employee handbook, cash/asset handling SOPs, CCTV policy, search/inspection consent clauses, confidentiality/trust agreements, job descriptions.

Make them admissible: Use originals or duly certified copies; keep custodians’ affidavits explaining how records are generated, kept, and retrieved.

2) Electronic evidence

CCTV/Body cam: original files (not just screenshots), with time stamps, device IDs, and export logs; preserve the full clip before and after the incident to show context.
System logs: POS, ERP, WMS, and email logs with audit trails (user IDs, timestamps, IP/MAC, event description).
Mobile/Chat extracts: export along with hash values or platform metadata where feasible.

Authentication tips:

Identify the system, the process generating the data, and the person with knowledge.
Document hashing or checksum on exported files, or at least maintain a media register (device, file name, size, date created/modified).
Keep a chain-of-custody log for sensitive media.

3) Testimonial evidence

Eyewitnesses: co-employees, security, supervisors; require sworn statements with specifics (date/time/place, exact acts seen, distance, lighting, identifiers).
Expert/competent witnesses: auditors or IT administrators to explain shortages, variance methodologies, or log systems.
Admissions/Confessions: Only if voluntary. Avoid threats, coercion, or promises. Prefer written statements in a language the employee understands, with a note that counsel/representative was allowed during administrative inquiry.

4) Forensic/accounting corroboration

Exception reports (e.g., high void rate, after-hours adjustments).
Benford/outlier analyses (for large data sets).
Cash-to-sales variance and inventory turnover anomalies. These are corroborative, not stand-alone, unless they link to the identified employee’s credentials/terminal/access.

V. Procedural due process (the two-notice rule + hearing)

Even with solid proof, dismissal fails without procedural due process:

First notice (charge notice / notice to explain):
- States the specific acts, dates, policies violated, and possible penalty.
- Give the employee reasonable time (best practice: at least five calendar days) to submit a written explanation and evidence.
Opportunity to be heard:
- Administrative conference where the employee may be assisted by a representative; receive and confront evidence; present rebuttal or witnesses.
Second notice (decision):
- Findings of fact, the rule/just cause violated, the evaluation of the defense, and the penalty imposed, effective date included.

Preventive suspension:

Allowed to protect company property or prevent interference with the investigation when the employee’s continued presence poses a serious and imminent threat.
Maximum 30 days. If investigation needs more time, reinstate the employee or extend with pay beyond 30 days.

VI. Building a “loss of trust” case the right way

A loss of trust and confidence (LOTAC) dismissal requires:

The employee occupied a position of trust (managerial, or fiduciary rank-and-file like cashiers, storekeepers).
A willful breach based on clearly established facts.
The evidence shows actual participation or culpable negligence tied to entrusted duties.

Weak LOTAC indicators (avoid these):

“There was shrinkage, therefore the cashier must have stolen.”
Collective guilt (“whoever was on shift is liable”).
Unexplained gaps in CCTV or logs; selective clips without context.
Policies never acknowledged by the employee.

VII. Searches, interviews, and privacy

Bag/locker searches: ensure advance consent via policy; conduct reasonable and non-intrusive checks; same-sex security for personal searches; always with witnesses; document the search and items found; offer the employee a receipt.
CCTV and monitoring: post privacy notices, restrict footage access to need-to-know personnel, and retain only as long as necessary.
Data Privacy compliance: collect only what is proportionate; secure storage; limited sharing (e.g., with counsel, law enforcement, courts).
Interviews: avoid coercion; note that constitutional custodial rights attach in police custodial investigations—not in routine private employer HR inquiries—but coercion can still invalidate statements and create liability.

VIII. From investigation to decision: a practical workflow

Incident intake: report, tip, or exception alert.
Preserve evidence immediately: isolate POS and CCTV, seal cash tills, copy server logs, suspend auto-deletions.
Scoping memo: list hypotheses; map who, what, when, where, how; identify systems and custodians.
Collect & authenticate: pull records, export logs, inventory counts; secure sworn statements.
Link analysis: tie loss to employee credentials, shift, device, footage, document trail.
Charge notice; grant time to respond; conference.
Evaluate defenses: look for alibis, alternative causes (system errors, policy gaps).
Decision notice with findings; if dismissal, compute final pay subject to lawful set-offs; issue certificate of employment upon request.
If criminal referral is appropriate: compile a case file (elements checklist, evidence index, chain of custody) and coordinate with counsel/law enforcement.

IX. Special contexts and nuances

Multiple suspects: You may proceed individually; do not impose collective penalties without individualized proof.
Repeated petty losses: Pattern evidence can support gross and habitual neglect or misconduct if linked to the employee’s functions.
Recovery/restitution: Paying back losses does not erase the offense or bar dismissal/criminal action, but it may mitigate penalties in internal policy.
Acquittal in criminal case: Does not automatically invalidate a prior dismissal if the administrative record met the substantial evidence standard.
Quitclaims/waivers: Must be voluntary, clear, and reasonable. They do not bar labor complaints if shown to be vitiated by fraud, coercion, or unconscionable consideration.
Financial assistance: Generally not awarded when dismissal is for serious misconduct or acts reflecting moral depravity.

X. Evidence checklists

A. Documentary & digital packet

Incident report; audit/inventory sheets; variance computations
POS/WMS/ERP exports; exception reports; access logs
CCTV footage (raw + exported), export logs, device info
Policies/SOPs; employee acknowledgments; job description
Custodian affidavits (records, IT, security)
Witness affidavits; interview minutes; employee’s written explanation
Seizure/search logs; photo documentation; receipts for seized items
Chain-of-custody register for media and seized property

B. Due process packet

Notice to Explain with detailed allegations and evidence list
Proof of service and five-day response period (or reason for shorter)
Hearing/conference minutes; attendance sheet; audio/video if any
Decision Notice with findings, rule breached, penalty, effectivity date
Preventive suspension memo(s), if any, with dates and basis

C. Criminal referral packet (if pursued)

Elements checklist (theft/qualified theft/estafa)
Sworn statements; CCTV and logs (with authentication)
Valuation/ownership proof (OR/CR, titles, invoices, inventory)
Proof of lack of consent/abuse of confidence; demand letters (for estafa)
Chain-of-custody and media hashes, if available

XI. Common pitfalls (and how to avoid them)

Skipping the first notice or giving a vague charge (“dishonesty” without specifics).
Relying solely on shortages without linking to the employee’s acts, device, or access.
Edited CCTV with missing context; failure to produce the raw file.
Unacknowledged policies; you can’t penalize for procedures the employee never received.
Overlong preventive suspensions without pay beyond 30 days.
Fishing expeditions that violate privacy or dignity; courts punish abusive searches and coerced confessions.
Late or inconsistent documentation; contemporaneous records are more credible.

XII. Model templates (skeletal)

A. Notice to Explain (NTE)

Subject/Charge: Serious Misconduct; Fraud/Willful Breach; Commission of an offense.
Facts: Date/time/place; item(s) involved; value; policy clauses; documents and media you rely on (attach or make available).
Directive: Submit written explanation within five (5) calendar days and attend a conference on [date].
Advisory: Right to be assisted by a representative.

B. Decision Notice

Findings of Fact with references to exhibits/logs/footage.
Rule/Just Cause violated and reasoning.
Penalty and effectivity; clearance/turnover instructions; final pay accounting.
Advisory on internal appeal (if any).

XIII. Practical FAQs

Is a positive CCTV clip alone enough? Often, yes, if the footage is clear, authenticated, and context is provided (ownership, lack of consent, identity). Always corroborate with logs or inventory when possible.

Do I need complainant testimony if inventory proves loss? For labor cases, not always, but you must connect the loss to the employee through duty assignments, access, or conduct.

Can I search an employee’s bag? If you have policy-based consent and reasonable grounds, conducted decently and with witnesses. Avoid invasive searches without strong necessity.

What if the employee refuses to submit an explanation? Document the refusal or non-appearance; proceed to decision based on the record, noting that the opportunity to be heard was afforded.

Should I file a criminal case first? Not required. Administrative action can proceed independently on substantial evidence.

XIV. Closing guidance

Think triangle: (1) Evidence integrity, (2) Clear linkage to the employee’s entrusted functions, and (3) Procedural due process. When these three corners are solid, a dismissal for theft-related misconduct is far more likely to withstand challenge—and if you decide to prosecute, your criminal case starts on firmer ground.