Quick answer

A Philippine employer may investigate suspected employee fraud or falsified records and may impose discipline, including dismissal, but it must establish both:

A valid, fact-based ground for discipline; and
Fair procedure before deciding to dismiss.

Fraud or a willful breach of trust is a just cause for termination under Article 297 of the Labor Code. Falsification may also constitute serious misconduct, dishonesty, violation of a lawful company rule, or another analogous cause, depending on the employee’s duties and the proven facts.

Suspicion, an audit discrepancy, an unsigned accusation, or the label “loss of confidence” is not enough by itself. The employer must identify the specific act, give the employee a meaningful opportunity to answer it, evaluate the response impartially, and base any dismissal on substantial evidence.

This article primarily covers private-sector employment. Government employees, seafarers, and employees governed by a collective bargaining agreement or special disciplinary rules may be subject to additional or different procedures.

What must be proved

Fraud or willful breach of trust

For dismissal based on fraud or loss of trust and confidence, the employer ordinarily must show that:

The employee occupied a position of trust and confidence;
The employee committed an act that justified the loss of trust;
The breach was intentional, knowing, and purposeful—not merely careless or inadvertent;
The act was connected with the employee’s work and showed unfitness to continue in the position; and
The conclusion rests on substantial evidence, not speculation, prejudice, or an unsupported accusation.

Positions of trust generally include managerial employees and fiduciary rank-and-file employees who routinely handle significant money, property, records, approvals, or similarly sensitive responsibilities. A job title alone is not controlling; the employee’s actual functions matter.

The Supreme Court has repeatedly warned that loss of confidence is subjective and may easily be abused. It must be genuine and supported by clearly established facts. See San Miguel Corporation v. Gomez and Jalit v. Cargo Safeway, Inc..

Falsified or altered records

Falsification may involve, for example:

Fabricated receipts, invoices, medical certificates, attendance records, or liquidation documents;
Altered dates, amounts, signatures, approvals, or supporting attachments;
False entries in payroll, inventory, accounting, sales, compliance, or customer records;
Use of another person’s account or credentials to create an apparently authorized transaction;
Deletion or concealment of records intended to hide an irregularity; or
Knowing submission or approval of information the employee understood to be false.

The employer should prove more than the fact that a record is inaccurate. It should determine who created, altered, submitted, or approved it; whether the employee acted knowingly; what access the employee had; whether another person could have made the entry; and whether an innocent explanation is reasonably supported.

A clerical mistake, ambiguous instruction, system defect, shared password, incomplete training, or negligent review is not automatically fraud. Such circumstances may still justify corrective or disciplinary action under a valid company rule, but they should not be relabeled as intentional dishonesty without evidence.

The correct investigation and disciplinary process

The governing procedural standard appears in DOLE Department Order No. 147-15 and Supreme Court decisions applying the twin-notice rule.

1. Secure the records without deciding guilt in advance

The employer should promptly preserve relevant evidence, such as:

Original paper records and certified copies;
Native electronic files and available metadata;
Audit trails, access logs, version histories, and approval workflows;
Relevant emails, messages, CCTV footage, and system-generated reports;
Written policies, job descriptions, authorization matrices, and prior instructions;
Specimen signatures or authentic comparison records, when relevant;
Statements from witnesses with personal knowledge; and
Records showing custody, collection, copying, transfer, and analysis of evidence.

Access should be limited to people who have a legitimate role in the investigation. Investigators should preserve originals, work from forensic or verified copies where feasible, and document every material handling step. Evidence obtained through unlawful, disproportionate, or unauthorized access may create separate privacy, employment, or evidentiary problems.

The investigation should test both incriminating and exculpatory explanations. It should not be designed merely to confirm an accusation already treated as true.

2. Define the exact charge

Before issuing a notice, identify:

The particular document, entry, transaction, or incident involved;
The date, place, amount, account, or other identifying details;
The act attributed to the employee;
The evidence connecting the employee to that act;
The relevant Labor Code ground; and
The specific company policy allegedly violated, if any.

Do not use a vague accusation such as “fraud,” “dishonesty,” or “loss of trust” without explaining the underlying conduct.

Charges against several employees should be individualized. Mere presence in the same department, access to the same system, or association with another accused employee does not establish participation.

3. Serve a detailed first written notice

The first notice—often called a notice to explain or NTE—should:

Describe the acts or omissions in sufficient detail;
Identify the applicable ground and company rule;
Explain that dismissal is being considered, if that is a possible penalty;
Provide enough information for the employee to prepare a real defense;
Direct the employee to submit a written explanation; and
Give the employee at least five calendar days from receipt to respond.

The employee should receive the evidence or a sufficiently specific account of it, subject to legitimate protection of confidential third-party information. If essential materials cannot safely be copied, the employer may arrange a reasonable opportunity to inspect them.

The notice should be personally served when practicable or sent to the employee’s last known address using a method that documents delivery or attempted delivery. Keep proof of receipt, refusal, return, or other service history.

4. Give a meaningful opportunity to be heard

Due process requires a real opportunity to answer—not necessarily a courtroom-style trial.

A formal conference or hearing becomes particularly important when:

The employee requests one in writing;
Material facts are substantially disputed;
Witness credibility must be assessed;
Company rules or established practice require it; or
Similar circumstances make a conference necessary for a fair evaluation.

At the conference, the employee should be permitted to explain, identify supporting documents, answer relevant questions, and raise inconsistencies in the accusation. Assistance by a representative or counsel should be allowed when required by the collective bargaining agreement, company rules, or the circumstances.

Prepare accurate minutes or a recording with appropriate notice and lawful safeguards. A refusal to sign minutes should be documented; it should not be treated automatically as an admission.

If the employee does not respond despite valid service and a reasonable opportunity, the employer may decide using the available evidence. Silence, however, does not relieve the employer of proving a just cause.

5. Investigate the employee’s explanation

A fair decision-maker should verify material defenses rather than dismissing them summarily. This may require checking:

Whether credentials were shared or compromised;
Whether records were backdated under an authorized practice;
Whether a supervisor directed or approved the disputed entry;
Whether the system records local time, server time, or a different user identity;
Whether signatures are originals, scans, reproductions, or electronically applied;
Whether the alleged loss is accurately calculated;
Whether witnesses actually observed the event; and
Whether comparable cases were treated consistently.

If the inquiry uncovers a materially different offense, issue a supplemental notice and give another meaningful opportunity to answer that new charge. An employer should not dismiss an employee for grounds that were absent from the notice and never subjected to an explanation process. The Supreme Court rejected that kind of shifting accusation in Foodbev International Consulting Corporation v. Ferrer.

6. Decide on substantial evidence

In a labor case, substantial evidence means relevant evidence that a reasonable mind might accept as adequate to support a conclusion. This is lower than proof beyond reasonable doubt, but it still requires objective and credible support.

Assess the evidence as a whole, including:

Authenticity and reliability;
Direct knowledge versus hearsay;
Consistency among documents and witnesses;
The employee’s authority, access, and motive;
Alternative explanations;
Whether the act was intentional;
The employee’s actual responsibilities; and
Whether the proposed penalty is proportionate under the law, policy, and relevant circumstances.

An internal administrative finding is not a criminal conviction. Conversely, the absence of a criminal case—or an acquittal under the higher criminal standard—does not automatically determine the employment case. Each process has its own legal elements, evidence, and standard of proof.

7. Serve a reasoned second written notice

If discipline is imposed, the final notice should state:

The charge evaluated;
The material facts established;
The employee’s defenses and evidence considered;
The ground and company rule found applicable;
The penalty and its effective date; and
Any internal appeal or review available under company policy or a collective bargaining agreement.

For dismissal, the second notice must communicate that all relevant circumstances were considered and that grounds were established to justify termination. It should not simply repeat the accusation or announce a predetermined result.

The decision must match the charge actually investigated. A termination notice that suddenly relies on additional misconduct, habitual absence, or another uncharged offense is vulnerable to challenge.

Preventive suspension is limited

Preventive suspension is not a punishment and should not be automatic whenever fraud is alleged. It may be used only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers—for example, a genuine risk of further unauthorized transactions, interference with critical records, or destruction of evidence.

The employer should document the particular threat and consider less restrictive safeguards, such as temporary reassignment, removal of system privileges, dual approvals, or restricted access.

Preventive suspension generally cannot exceed 30 days. After that period, the employee must be reinstated to the former or a substantially equivalent position, or the suspension may be extended with payment of wages and benefits during the extension. If the original suspension lacked sufficient basis, payment for the suspension period may be due. See the Omnibus Rules Implementing the Labor Code and Maula v. Ximex Delivery Express, Inc..

A preventive-suspension letter should state that no final finding has been made, explain the serious and imminent threat, identify the start date, and specify the applicable conditions.

Privacy and confidentiality during the investigation

Employment investigations frequently involve personal information, financial data, communications, medical documents, identification records, and information about witnesses or customers. Processing must comply with the Data Privacy Act of 2012 and its Implementing Rules and Regulations.

As a practical matter, the employer should:

Identify a lawful basis for collecting and using the information;
Collect only information necessary for the defined investigation;
Restrict access to authorized personnel and advisers;
Use secure transfer, storage, and disposal methods;
Avoid unnecessary disclosure of the allegation or evidence;
Retain records only as long as justified by legal and operational needs; and
Coordinate with the data protection officer where sensitive or extensive processing is involved.

Confidentiality should not be used to prevent the employee from understanding and answering the charge. Where disclosure would expose protected third-party data, use proportionate measures such as redaction, controlled inspection, confidentiality undertakings, or a sufficiently detailed summary.

Publicly announcing that an employee committed fraud before a fair investigation can cause reputational harm and may create separate legal exposure.

Parallel criminal or regulatory action

Falsified records may potentially implicate the Revised Penal Code, special laws, tax or corporate regulations, professional rules, or sector-specific reporting duties. Whether a criminal or regulatory violation exists depends on the document, manner of falsification, intent, use, resulting prejudice, and other statutory elements.

An employer considering referral to law enforcement or a regulator should:

Preserve originals and establish a clear evidence-custody record;
Avoid altering, annotating, or repeatedly handling the questioned document;
Obtain appropriate technical or forensic assistance;
Separate verified facts from assumptions in any report;
Protect privileged legal advice and personal data; and
Confirm any sector-specific reporting deadline promptly.

Do not threaten criminal prosecution merely to force a resignation, repayment, confession, or waiver of labor rights. A repayment agreement or resignation also does not automatically erase possible criminal, civil, regulatory, or employment consequences.

Choosing a proportionate outcome

Dismissal may be justified when the proven conduct meets a statutory just cause, particularly where deliberate falsification directly betrays duties involving money, property, approvals, or sensitive records. But dismissal is not automatic in every inaccurate-record case.

Relevant considerations may include:

The employee’s position and degree of trust;
Intent and level of participation;
Nature and importance of the record;
Actual or potential prejudice;
Concealment, repetition, or coordinated conduct;
Prior disciplinary history, if lawfully relevant;
Clear company rules and communicated penalties;
Treatment of comparable cases; and
Mitigating or aggravating circumstances.

Possible outcomes include no charge, counseling, correction of records, retraining, a written warning, suspension as a disciplinary penalty under a valid rule, restitution arrangements, or dismissal. The choice must still comply with law, contract, company policy, and any collective bargaining agreement.

A company rule cannot create a lawful basis for dismissal where the facts do not satisfy the Labor Code. Conversely, a single serious and intentional act may justify dismissal when it constitutes a statutory just cause; the employer need not manufacture a record of progressive discipline first.

Evidence employees should preserve

An employee accused of fraud or falsification should preserve lawfully accessible copies of:

The notice to explain and proof of when it was received;
The questioned record and attachments;
Relevant emails, instructions, approval messages, and workflow history;
Job description, handbook, code of conduct, and applicable policies;
Written explanation and proof of submission;
Hearing notices, minutes, recordings, and correspondence;
Preventive-suspension and termination notices;
Payslips, time records, and employment documents;
Names of witnesses with direct knowledge; and
Documents supporting an innocent explanation, authorization, system problem, or inconsistent treatment.

Do not delete, alter, fabricate, or secretly remove company records. Do not access systems after authority has been suspended or revoked. Preserve personal evidence through lawful means and request access or copies in writing when necessary.

If asked to sign a document, read it carefully. An employee may acknowledge receipt without necessarily admitting the allegations, but should clearly state any reservation if the form’s wording suggests agreement.

Common mistakes by employers

Treating an audit exception as conclusive proof of fraud;
Issuing a vague notice that does not identify the transaction or conduct;
Allowing less than five calendar days for the written explanation;
Preparing the termination decision before receiving and evaluating the defense;
Changing the charge between the NTE and termination notice;
Relying on unauthenticated screenshots or unexplained spreadsheets;
Ignoring evidence that another person had access or authority;
Assuming that every employee is in a position of trust;
Using preventive suspension as punishment or exceeding 30 days without pay;
Pressuring the employee to resign instead of completing due process;
Publicizing allegations unnecessarily; and
Confusing an internal finding with proof of a criminal offense.

Common mistakes by employees

Ignoring the notice or responding only verbally;
Giving a blanket denial without addressing each transaction;
Missing the response deadline without requesting an extension;
Deleting messages or altering records after learning of the investigation;
Signing an admission, resignation, quitclaim, or repayment agreement without understanding it;
Taking confidential company data unrelated to the defense;
Contacting witnesses in a manner that could appear coercive; and
Waiting too long to obtain advice after suspension or dismissal.

If more time is genuinely needed, request a specific, reasonable extension in writing before the deadline and explain why. The employer should consider the request fairly, especially when records are numerous or inaccessible.

If due process was not followed

Substantive and procedural due process are separate questions.

No just cause proved: The dismissal may be illegal. Under Article 294 of the Labor Code, the usual statutory remedies include reinstatement without loss of seniority and full backwages, subject to the facts and the final ruling. Separation pay may be awarded instead of reinstatement in appropriate circumstances.
Just cause proved, but procedure violated: The dismissal may remain effective, but the employer may be liable for nominal damages. In Agabon v. NLRC, the Supreme Court set the nominal award at ₱30,000 for a just-cause dismissal effected without the required procedure. The actual remedy remains subject to controlling law and the circumstances adjudicated.
Improper preventive suspension: The employee may be entitled to wages for the unjustified period or for an unpaid extension beyond the legal limit.

An employee may seek assistance through the Department of Labor and Employment’s Single Entry Approach and, if unresolved, pursue the appropriate case before a Labor Arbiter. An illegal-dismissal complaint generally prescribes in four years from accrual, although related money claims may be governed by different periods. Early action is safer because evidence, witnesses, and practical remedies can deteriorate well before prescription. The Supreme Court discusses the four-year rule in Gallego v. Bayer Philippines, Inc..

When legal help is urgent

Prompt advice from a Philippine labor lawyer or the appropriate government office is especially important when:

A termination notice has already been served;
The NTE gives inadequate time or conceals the transaction being charged;
Preventive suspension is approaching or has exceeded 30 days;
The employee is being pressured to resign, confess, repay, or sign a quitclaim;
Police, the NBI, a prosecutor, a regulator, or an external auditor is involved;
Original documents or large amounts of electronic evidence may be lost;
The allegation involves substantial losses, senior officers, regulated records, or multiple employees;
Company devices or personal accounts are being searched;
Retaliation, discrimination, union activity, or whistleblowing may be involved; or
A collective bargaining agreement provides a short grievance deadline.

Practical investigation checklist

For employers

Preserve original and electronic evidence.
Limit access and document custody.
Identify the exact conduct and governing rule.
Check the employee’s actual authority and duties.
Test alternative explanations.
Issue a specific first notice.
Allow at least five calendar days to explain.
Hold a conference when required or necessary.
Investigate the defense and any new evidence.
Issue a reasoned decision matching the charge.
Observe preventive-suspension limits.
Protect privacy and document every procedural step.

For employees

Note the exact receipt date and deadline.
Request the supporting particulars or records needed to answer.
Preserve lawful evidence immediately.
Address each allegation separately and factually.
Identify authorizations, system issues, and other persons with access.
Attach supporting records and name relevant witnesses.
Request a conference or reasonable extension when necessary.
Keep proof of every submission.
Avoid altering or removing company information.
Obtain prompt advice before signing a resignation, admission, or settlement.

FAQ

Can an employee be dismissed immediately after falsification is discovered?

Ordinarily, no. Even apparently strong evidence does not eliminate the twin-notice process and meaningful opportunity to be heard. Immediate access restrictions or a properly justified preventive suspension may be possible while the investigation proceeds.

Is a hearing always required?

A trial-type hearing is not always required. A meaningful written opportunity to answer may suffice, but a conference should be provided when the employee requests it in writing, material facts are disputed, company rules require it, or the circumstances make it necessary for fairness.

Is five calendar days a mandatory response period?

DOLE Department Order No. 147-15 treats a reasonable opportunity as at least five calendar days from receipt of the first notice. More time may be appropriate when the charge is complex or the needed records are extensive or inaccessible.

Does an employee’s failure to explain prove fraud?

No. It may amount to waiver of the opportunity to present a defense after proper notice, but the employer must still establish a valid cause through substantial evidence.

Must the employer prove an actual financial loss?

Not always. Deliberate falsification may seriously breach trust even if a loss was prevented. But the employer must still prove the employee’s act, intent, work connection, and the legal ground invoked. Any claimed amount of loss should be supported separately.

Can loss of trust apply to an ordinary rank-and-file employee?

Only in appropriate cases, particularly where the employee’s actual duties routinely involve significant money, property, records, or similarly sensitive matters. It should not be applied merely because every employee is expected to be honest.

May the employer search the employee’s email or device?

That depends on ownership, workplace policies, reasonable privacy expectations, necessity, proportionality, authorization, and applicable privacy law. A company-owned account is not a blanket license for unlimited or unrelated access. Personal accounts and devices require particular caution.

Does repayment prevent dismissal?

Not necessarily. Repayment may be relevant to mitigation but does not automatically erase a proven intentional breach of trust. It also does not establish guilt by itself, especially if payment was made under pressure or without an admission.

Can the employer file a criminal complaint while the administrative case is pending?

Potentially, yes. The proceedings are distinct. The employer should preserve evidence properly and obtain advice on the elements of the possible offense. The internal decision must still comply with labor due process.

May an employee secretly record the disciplinary meeting?

Recording laws, privacy interests, company rules, and the circumstances may affect legality and admissibility. The safer course is to request permission or ask for official minutes, a copy of any company recording, or attendance by a representative.

Are government employees covered by this procedure?

Not primarily. Government personnel are governed by civil-service laws, administrative disciplinary rules, constitutional due process, and agency-specific regulations. The charges, preventive suspension rules, deciding authority, and appeal deadlines can differ materially.

Official legal sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Employment contracts, company rules, collective bargaining agreements, evidence, job functions, and procedural history may change the analysis. Official sources were checked for current general rules as of August 26, 2026.