Quick answer

An employer in the Philippines may investigate suspected employee fraud, dishonesty, tampering, fabricated transactions, falsified company records, altered receipts, false time records, or similar misconduct. If the evidence ultimately establishes a just cause under the Labor Code, dismissal may be lawful. But an accusation of “fraud” or “falsification” does not by itself justify immediate termination.

For a defensible dismissal, the employer generally must establish both substantive and procedural due process. Substantively, the charge must be supported by substantial evidence and must actually amount to a recognized just cause, such as serious misconduct, fraud or willful breach of trust, or loss of confidence in an employee occupying a position of trust. Procedurally, Article 292(b) of the Labor Code and DOLE Department Order No. 147-15 require the employer to give the employee specific written charges, a meaningful opportunity to answer and present evidence, and a written decision after the defense has been considered. (eLibrary)

For dismissals based on just cause, the employee must ordinarily be given at least five calendar days from receipt of the first notice within which to prepare an explanation. A formal hearing is not automatically required in every case, but it becomes mandatory when the employee requests one in writing, when substantial evidentiary disputes exist, when company rules or practice require one, or when similar circumstances justify it. (eLibrary)

The safest approach is therefore not “discover irregularity, then terminate.” It is preserve the evidence, investigate objectively, issue a specific notice to explain, allow a meaningful defense, resolve disputed evidence fairly, and only then decide whether discipline—including dismissal—is justified.

What legal grounds may apply to falsified records or employee fraud?

Article 297 of the Labor Code permits termination for just causes that include serious misconduct and fraud or willful breach of the trust reposed in the employee. DOLE Department Order No. 147-15 separately identifies standards for fraud, willful breach of trust, and loss of confidence. (eLibrary)

Fraud or willful breach of trust requires an act, omission, or concealment involving a breach of a legal duty, trust, or confidence justly reposed in the employee, committed against the employer or its representative and connected with the employee's work. Loss of confidence additionally requires, among other matters, an act justifying the loss of trust and an employee occupying a position of trust and confidence; the asserted loss of confidence must be genuine rather than simulated, arbitrary, or invented after the fact. (eLibrary)

Serious misconduct may also apply even where “loss of confidence” is not the best legal theory. The misconduct must be grave rather than trivial, related to the employee's duties, and of a character showing that the employee has become unfit to continue working for the employer. Wrongful intent matters. (eLibrary)

This distinction is important because not every inaccurate document is fraudulent. A clerical mistake, misunderstanding, erroneous encoding, negligent entry, mistaken reconciliation, or alteration made without fraudulent intent may have very different legal consequences from an intentional fabrication designed to obtain money, conceal a shortage, falsify attendance, hide an unauthorized transaction, or deceive management.

The Supreme Court has upheld dismissal where substantial evidence established knowingly fraudulent use of forged company forms by an employee whose duties involved custody of company materials. (eLibrary) But the Court has also rejected attempts to treat altered records automatically as a dismissible offense where the required wrongful intent or sufficient factual basis was not adequately established. In Coca-Cola Export Corporation v. Gacayan, for example, the Court stressed that loss of confidence must rest on clearly established facts and that serious misconduct requires wrongful intent. (eLibrary)

The lesson is straightforward: investigate the conduct and intent, not merely the appearance of the document.

The employer carries the burden of proof

If a dismissal is challenged, the employer bears the burden of proving that termination rested on a valid cause. The applicable standard in a labor case is generally substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion. (eLibrary)

This is lower than the criminal standard of proof beyond reasonable doubt, but it is still evidence. Suspicion, office gossip, unexplained discrepancies, management's subjective belief, or an accusation unsupported by records may not be enough.

The Supreme Court has repeatedly cautioned that loss of confidence cannot become a convenient label for dismissal. Particularly for rank-and-file employees, mere uncorroborated accusations are insufficient; involvement in the alleged wrongdoing must be supported by evidence. (eLibrary)

A sound investigation process

A Philippine employer investigating suspected fraud or falsified records can substantially reduce legal risk by following a disciplined process:

Secure potentially relevant evidence before it can be altered or lost. Preserve original documents, system records, transaction histories, approval trails, emails, accounting entries, CCTV where lawfully available, access logs, audit reports, receipts, time records, inventory movements, and other records relevant to the suspected irregularity. Where electronic records matter, preserve the original data and metadata rather than relying only on screenshots.
Conduct preliminary fact-finding before making accusations. Determine what happened, when it happened, which record is allegedly false, who prepared or approved it, what system generated it, whether the employee had access or authority, whether there are legitimate explanations, and whether other people could have created or modified the information. A preliminary audit or investigation may occur before the formal notice to explain; it does not replace the employee's later right to answer specific charges.
Identify the actual disciplinary theory. Decide whether the evidence potentially supports serious misconduct, fraud or willful breach of trust, loss of confidence, violation of a lawful company rule, or another legally recognized cause. Avoid simply using every possible legal ground. The facts should fit the ground invoked.
Issue a detailed first written notice or notice to explain. State the specific alleged acts, relevant dates, transactions or records, applicable company rule and Labor Code ground, and enough factual detail for the employee to understand what must be answered. Avoid vague allegations such as “dishonesty,” “fraud,” or “falsification of records” without identifying the underlying transaction or conduct.
Give the employee a genuine opportunity to defend themselves. The reasonable period under Department Order No. 147-15 is at least five calendar days from receipt of the notice. The employee should be able to submit an explanation and supporting records and may obtain the assistance of a representative if desired. (eLibrary)
Hold a conference or hearing when required. A trial-type hearing is not mandatory in every termination case. It becomes necessary, however, when requested by the employee in writing, when substantial evidentiary disputes need resolution, when company policy or established practice requires it, or when comparable circumstances make a hearing appropriate. (eLibrary)
Evaluate both incriminating and exculpatory evidence. Determine whether the record establishes intentional falsification, participation, knowledge, benefit, concealment, or another culpable act. Consider the employee's explanation and supporting documents instead of treating the notice-to-explain stage as a formality after management has already decided to dismiss.
Issue a reasoned second written notice only after evaluation. If dismissal is justified, the termination notice should show that the circumstances and the employee's defense were considered and that grounds were found sufficient to terminate employment. Department Order No. 147-15 directs that the notices be served personally or at the employee's last known address. (eLibrary)

What should the notice to explain contain?

The first notice is one of the most important documents in the investigation.

It should identify the specific acts being investigated, not merely the legal conclusion management hopes eventually to prove. If the concern involves a falsified reimbursement, for example, the notice should ordinarily identify the reimbursement, receipt or supporting document, date, amount, alleged alteration, employee's apparent participation, and relevant company policy.

If an accounting entry was allegedly fabricated, identify the journal entry or transaction, the discrepancy, the employee's role in preparing or approving it, and the evidence giving rise to the charge.

The Supreme Court's due-process cases emphasize that an employee must receive enough detail to prepare an intelligent defense. A general description of the charge is not sufficient where the employee cannot reasonably determine which specific event or transaction must be answered. The minimum five-calendar-day period exists precisely to permit the employee to study the accusation, consult a representative or lawyer if desired, collect records, and decide on a defense. (eLibrary)

The notice should also avoid prematurely stating that the employee “committed fraud” as an established fact when the investigation has not yet been completed. Phrases such as “alleged falsification,” followed by the specific facts, help preserve the distinction between accusation and adjudication.

Must the employee be shown the evidence?

Due process requires a meaningful opportunity to respond, not necessarily a courtroom-style discovery process.

The Supreme Court has recognized that an employee answering disciplinary charges may present relevant company records and may ask the employer for records material to the defense. (eLibrary)

In practice, an employer should be careful about relying on supposedly decisive documents while withholding enough information that the employee cannot meaningfully answer them. At the same time, confidential information, personal data belonging to others, trade secrets, whistleblower identities, or legally privileged material may require careful handling.

A practical solution is to provide or describe the evidence sufficiently for a meaningful response while redacting unrelated confidential information where legally appropriate.

Is an administrative hearing always required?

No.

Philippine law requires an ample opportunity to be heard, which may occur through a written explanation, conference, hearing, or another fair and reasonable process. A full trial-type hearing is therefore not automatically required merely because dismissal is being considered. (eLibrary)

A hearing becomes mandatory, however, when the employee requests it in writing, a substantial factual dispute requires resolution, company rules or established practice require one, or similar circumstances justify it. (eLibrary)

This can be particularly important in fraud investigations where one witness blames another, an employee disputes authorship of an electronic transaction, signatures are contested, system access is shared, or the reliability of an audit methodology is genuinely disputed.

Can the employee be preventively suspended?

Sometimes, but preventive suspension is not an automatic consequence of a fraud accusation.

Under the implementing rules, an employee may be placed under preventive suspension when continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. Without that kind of threat, preventive suspension is not proper. (eLibrary)

In a fraud investigation, this requirement may potentially be satisfied where the employee's continued access creates a genuine and imminent risk to company money, inventory, systems, critical records, or evidence. The justification should be documented rather than assumed simply because the charge sounds serious.

Preventive suspension generally may not exceed 30 days. After that period, the employer must reinstate the employee to the former or a substantially equivalent position, or may extend the suspension while paying the wages and benefits due during the extension. (eLibrary)

An unjustified preventive suspension can expose the employer to liability for wages covering the improper suspension. (eLibrary)

Falsification does not automatically mean dismissal

Employers should resist “zero analysis” even when a handbook calls dishonesty or falsification a dismissible offense.

The particular circumstances still matter. Relevant considerations may include whether the alteration was intentional, whether the employee knew the information was false, whether the record was material, whether the act was connected with work, the employee's degree of responsibility, whether company money or property was placed at risk, whether concealment occurred, whether the employee personally benefited, whether the position required special trust, whether comparable violations were treated consistently, and whether dismissal is proportionate under the circumstances.

Long service or a clean record does not automatically excuse a serious breach of trust, particularly for employees entrusted with sensitive financial or company property. Conversely, an employer should not characterize an innocent or merely negligent error as intentional fraud simply because dismissal would be administratively convenient.

Positions of trust require special analysis

Loss of trust and confidence is especially relevant to managerial employees and employees who, in the ordinary performance of their work, handle significant amounts of money or property, such as cashiers, auditors, and property custodians. Department Order No. 147-15 recognizes these categories of positions of trust. (eLibrary)

Still, the job title alone does not establish a valid dismissal. There must be an act justifying the loss of confidence, and the loss must be genuine and supported by facts.

The Supreme Court has emphasized that even where an employee occupies a position of responsibility, loss of confidence must not be arbitrary, simulated, or a mere afterthought. (eLibrary)

For rank-and-file personnel who do not normally occupy fiduciary positions, the employer should be particularly cautious about relying mechanically on “loss of trust.” A different Article 297 ground, such as serious misconduct, may better correspond to proven intentional falsification if its legal elements are actually present.

What evidence should be preserved?

For the employer, the strongest investigation file normally contains contemporaneous business records rather than conclusions drafted after the dispute has begun. Preserve originals and reliable copies of the questioned documents; audit reports and working papers; accounting and ERP records; approval histories; login and access logs; emails and messages relevant to the transaction; CCTV where relevant and lawfully available; inventory records; receipts and bank records; applicable policies; acknowledgment of those policies; witness statements; notices and proofs of service; the employee's written explanation and attachments; minutes or records of any administrative conference; and the written final decision.

For the employee, preserve the notice to explain, termination notice, relevant company policies, emails, system screenshots or records, approvals, instructions from supervisors, receipts, attendance records, work logs, messages with co-workers, evidence showing that others had access to the system or documents, and proof of any request for records or a formal hearing.

Both sides should preserve documents in their original form whenever possible. Altering, reconstructing, selectively deleting, or backdating investigation records can create a much larger evidentiary problem than the original employment dispute.

Common mistakes that can make an otherwise defensible case vulnerable

Deciding to dismiss before asking for the employee's explanation. A notice to explain should not merely memorialize a conclusion management has already made.

Using a vague notice. “Fraud,” “dishonesty,” and “loss of confidence” are conclusions. The employee must be told the underlying acts and circumstances.

Giving less than the required opportunity to respond. For just-cause dismissal, Department Order No. 147-15 treats a reasonable period as at least five calendar days from receipt of the notice. (eLibrary)

Ignoring a written request for a hearing. Where the employee makes such a request, or where substantial evidentiary disputes exist, a formal conference or hearing becomes mandatory. (eLibrary)

Treating failure to explain as automatic proof of guilt. If an employee fails to respond after proper notice and a genuine opportunity, management may ordinarily proceed on the available record, but the employer must still possess substantial evidence supporting the charge.

Relying only on accusations. Statements such as “management lost trust” do not substitute for proof of the conduct that supposedly caused the loss of trust.

Imposing preventive suspension automatically. The statutory standard is serious and imminent threat to life or property—not simply the seriousness of the accusation. (eLibrary)

Ignoring the handbook, CBA, or established company procedure. If company rules or established practice provide additional disciplinary safeguards, failure to follow them can create an independent due-process problem. (eLibrary)

Does the employer need a criminal conviction?

No.

An employment investigation and a criminal prosecution apply different standards. A dismissal case generally turns on substantial evidence, while a criminal conviction requires proof beyond reasonable doubt.

The Supreme Court has accordingly held that an employee's acquittal in a criminal case does not automatically prevent an employer from establishing acts that justify loss of trust and confidence. (eLibrary)

The reverse is equally important: the mere filing of a police complaint or criminal allegation does not relieve the employer of its obligation to establish a valid labor-law ground for dismissal and observe employment due process.

An employer considering a criminal complaint for falsification, estafa, theft, or another offense should therefore analyze the criminal elements separately from the employment case rather than assuming that the two proceedings are interchangeable.

What happens if there was just cause but the employer skipped due process?

A procedurally defective dismissal is not always equivalent to a dismissal without substantive cause.

Under the Agabon doctrine, where a valid just cause for dismissal exists but the employer fails to observe statutory procedural due process, the dismissal may remain substantively valid while the employer becomes liable for nominal damages. The Supreme Court has repeatedly applied an award of ₱30,000 in just-cause dismissals where procedural due process was violated. (eLibrary)

That rule should not be treated as permission to “dismiss now and pay later.” If the employer cannot prove the substantive ground itself, the consequences can be substantially greater, including the remedies applicable to illegal dismissal.

If the dismissal is challenged

An employee may question the legality of a dismissal before the labor authorities. The NLRC confirms that termination disputes fall within the jurisdiction of Labor Arbiters and that proceedings are currently governed by the 2025 NLRC Rules of Procedure, which took effect on January 13, 2026. (National Labor Relations Commission)

The DOLE Single Entry Approach, or SEnA, provides a conciliation-mediation mechanism. Requests for Assistance may presently be filed onsite or online through the DOLE Assistance for Request Management System. DOLE describes the SEnA conciliation-mediation period as 30 calendar days. (DOLE ARMS)

A claim for illegal dismissal is generally treated as an action for injury to rights and is subject to a four-year prescriptive period from accrual. Other employment-related monetary claims can be subject to different periods, including the Labor Code's three-year period for money claims, so delay is risky even when an illegal-dismissal claim itself may not yet have prescribed. (eLibrary)

When legal help is urgent

Prompt advice is especially important where management is considering immediate termination before completing the notice process; the employee has been placed on preventive suspension approaching or exceeding 30 days; significant company funds, regulated records, tax documents, financial statements, medical records, government documents, or customer money are involved; criminal charges are being considered; electronic evidence may disappear; several employees may have used the same credentials or system access; a union or CBA procedure applies; the employee has requested a formal hearing that management is considering denying; or the employee has already received a termination notice and intends to challenge the dismissal.

For employers, legal review before the final termination decision is usually more useful than attempting to repair a defective investigation after dismissal.

For employees, obtaining advice while the notice-to-explain period is still running can be important because the written explanation, evidence submitted, requests for records, and request for a hearing may become central to any later labor case.

FAQ

Can an employer investigate an employee without first issuing a notice to explain?

Yes, an employer may ordinarily conduct preliminary fact-finding, auditing, or evidence preservation to determine whether there is a basis for a disciplinary charge. But if dismissal for just cause is eventually contemplated, preliminary fact-finding does not replace the required first written notice and meaningful opportunity to answer before the termination decision.

Is five days always required to answer a notice to explain?

For termination based on just cause, DOLE Department Order No. 147-15 states that the “reasonable period” for an employee's explanation should be construed as at least five calendar days from receipt of the first notice. (eLibrary)

Does the five-day period mean five working days?

No. The rule refers to calendar days, not merely working days. (eLibrary)

Can the company dismiss the employee immediately after receiving the explanation?

Management may decide after the employee has been afforded the required opportunity and the relevant circumstances and evidence have actually been evaluated. The second notice should reflect that the defense was considered and that sufficient grounds were found for termination. (eLibrary)

What if the employee admits altering a record?

An admission can be powerful evidence, but the employer should still determine exactly what was admitted, whether the act was intentional, the circumstances surrounding it, the applicable company rule and Labor Code ground, and whether the penalty imposed is legally sustainable. The required termination procedure should still be observed.

What if the employee refuses to sign the notice?

Refusal to sign does not necessarily prevent the process from continuing. The employer should document the attempted service carefully and comply with the prescribed modes of service. Department Order No. 147-15 provides for service personally or at the employee's last known address. (eLibrary)

Is falsifying attendance or time records potentially a dismissible offense?

It can be, particularly when intentional and sufficiently serious. Department Order No. 147-15 itself cites fabrication of time records in its discussion of serious misconduct. But the employer must still prove the conduct and satisfy the applicable substantive and procedural requirements. (eLibrary)

Can an employer suspend computer or financial-system access without suspending employment?

Depending on the employee's functions, company policies, contractual arrangements, and circumstances, an employer may consider proportionate security measures such as restricting access while an investigation proceeds. Care is needed where the measure effectively prevents the employee from working, reduces compensation, or otherwise functions as an unauthorized suspension or constructive dismissal. The legality depends on the facts.

Does an acquittal in a criminal falsification case automatically make the dismissal illegal?

No. Criminal liability requires a higher standard of proof. A labor tribunal may independently determine whether substantial evidence established a valid employment ground for dismissal. (eLibrary)

Official sources

DOLE Department Order No. 147-15, Series of 2015 — rules on just causes and termination due process: Supreme Court E-Library copy of Department Order No. 147-15

DOLE Bureau of Labor Relations — current issuances, including the Labor Code and Department Order No. 147-15: DOLE Bureau of Labor Relations issuances

Supreme Court — Perez v. Philippine Telegraph and Telephone Company, on the meaning of ample opportunity to be heard and when a formal hearing becomes mandatory: Supreme Court E-Library — Perez v. PT&T

Supreme Court — Coca-Cola Export Corporation v. Gacayan, addressing altered receipts, serious misconduct, wrongful intent, and loss of confidence: Supreme Court E-Library — Coca-Cola Export Corporation v. Gacayan

DOLE Single Entry Approach online Request for Assistance: DOLE Assistance for Request Management System

National Labor Relations Commission — current procedural information: NLRC Frequently Asked Questions

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for advice based on the actual notice, evidence, employment contract, company handbook, CBA, audit findings, job functions, and surrounding facts of a particular case. Fraud and falsification investigations are highly fact-sensitive, and apparently similar cases can produce different results depending on proof of intent, the employee's position, the materiality of the irregularity, the applicable company rules, and the process actually followed.

Law and official-source check: August 25, 2026.