This article explains the Philippine legal framework and best-practice procedures employers can use to address suspected employee theft. It covers administrative (labor) processes, criminal options, evidence handling, privacy considerations, and practical risk controls.

I. Why this matters

Theft—cash pilferage, inventory shrinkage, manipulation of refunds, payroll/expense fraud, data exfiltration—erodes margins and trust. Mishandling a case can expose the company to illegal-dismissal claims, data-privacy complaints, or even criminal countercharges. Philippine law allows dismissal for just cause, but procedural due process is mandatory.

II. Legal foundations

Labor Code (as renumbered) – Just Causes for Termination Dismissal may be based on just causes such as serious misconduct, fraud or willful breach of trust, or commission of a crime or offense by the employee against the employer, the employer’s immediate family, or authorized representative.
- “Loss of trust and confidence” (LOTC) is the common ground used for theft involving property/cash/data.
- LOTC applies more readily to managerial employees and fiduciary rank-and-file (e.g., cashiers, storekeepers, auditors, warehousemen, collectors), but still requires substantial evidence of a willful, work-related breach.
Due Process in Employee Dismissals Under DOLE rules (Department Order No. 147-15 and jurisprudence), the twin-notice and opportunity-to-be-heard requirements apply:
- First notice (Notice to Explain / NTE) stating the specific acts, policies violated, facts, and evidence; give the employee a reasonable period (commonly at least five [5] calendar days) to respond.
- Hearing or conference if requested or if needed to clarify facts.
- Second notice (Decision) stating the factual and legal basis for the penalty.
Preventive Suspension If the employee’s continued presence poses a serious and imminent threat to company property or coworkers, you may place the employee on preventive suspension (not a penalty) typically up to 30 days. Extensions require pay (or alternative measures like temporary reassignment) and must be justified in writing.
Standard of Proof Administrative cases require substantial evidence (relevant evidence that a reasonable mind might accept) — not “beyond reasonable doubt” (criminal) nor “preponderance” (civil).
Revised Penal Code & Related Laws
- Theft (Arts. 308–310), Qualified Theft, Estafa/Swindling (Art. 315) may apply alongside administrative action.
- Cybercrime Prevention Act (RA 10175) for computer-related fraud, illegal access, identity theft, or data interference.
- Intellectual property and trade secrets may implicate IP statutes and civil remedies.
- Data Privacy Act (RA 10173) governs CCTV use, access logs, and processing of personal data gathered during investigations.
Separation Pay Rule of Thumb For dismissals based on serious misconduct, fraud, or moral turpitude (e.g., theft), no separation pay is generally due (subject to narrow equitable exceptions not typically applicable to theft).

III. What counts as “theft” at work?

Physical assets: cash, merchandise, tools, supplies.
Intangible assets: confidential data, customer lists, source code, designs.
Scheme examples: cash skimming, void/refund abuse, “sweethearting,” inventory substitution, false expense claims, fuel pilferage, time theft paired with fraud (e.g., payroll manipulation), data exfiltration via email/USB/cloud.

Tip: Your Code of Conduct should define theft/pilferage, cover manipulation attempts (even if “no loss” occurred), and link each to a penalty grid.

IV. End-to-end procedure for employers

1) Immediate containment (without violating rights)

Secure evidence: freeze POS accounts, isolate logs, preserve CCTV, seal drawers/lockers with witnesses, image devices (by IT) following a chain-of-custody log.
Access control: suspend system credentials; if risk is high, consider preventive suspension.
Treat respectfully: no public shaming; avoid coercive “confessions”; ensure interviews are voluntary and documented.

2) Internal fact-finding

Appoint an investigation team (HR + line manager + Internal Audit/Legal).
Gather substantial evidence:
- CCTV excerpts with date/time stamps and a retention note
- POS/ERP logs, inventory counts, exception reports
- Receipts, gate passes, delivery notes, void/refund records
- Email/USB/cloud access logs (observe privacy and proportionality)
- Sworn incident reports and affidavits of witnesses
- A chain-of-custody register for physical and digital evidence
Prepare a fact matrix mapping each allegation to each piece of evidence.

3) First notice (NTE)

State: (a) specific acts (who/what/when/where/how), (b) company rules and legal grounds violated, (c) evidence relied upon, (d) deadline to explain (≥ 5 calendar days), and (e) the right to a conference and to submit supporting evidence.

4) Administrative conference / hearing

Ensure impartiality; allow the employee to be assisted by a representative if company policy or practice allows.
Record attendance, issues discussed, and exhibits marked.
Ask clarifying questions; allow the employee to rebut evidence.

5) Decision (second notice)

Provide a reasoned written decision: findings of fact; legal basis (e.g., serious misconduct, LOTC); penalty (dismissal, suspension, or lesser penalty); effectivity date.
If dismissing, address why trust can no longer be reposed (particularly for fiduciary/managerial roles).

6) After-action steps

Clearance and final pay: process in accordance with DOLE guidance; do not withhold pay unlawfully. Lawful offsets must be authorized by law or by the employee in writing for a lawful and reasonable purpose.
Return of property and access revocation; document in a turnover checklist.
Criminal referral: decide whether to file a police/NBI complaint with your evidence packet (administrative action is independent of criminal proceedings; an acquittal does not automatically negate a valid administrative dismissal supported by substantial evidence).

V. Keys to a defensible dismissal for theft

Clear rule + clear proof: Show the employee knew (or should have known) the rule and that the act was willful.
Role sensitivity: For managerial or fiduciary rank-and-file, a well-documented loss of trust can justify dismissal even for a single grave incident.
Procedural rigor: Twin-notice, reasonable time to explain, meaningful opportunity to be heard.
Proportionality: Align penalty with the gravity of the act, the role, and past record.
Respect for dignity & privacy: No public accusations; handle CCTV and device searches lawfully and proportionately.

VI. Evidence & documentation toolkit

Documents: NTE, invitation to conference, minutes, decision, preventive-suspension memo, chain-of-custody log, inventory sheets, audit variance reports.
Affidavits: security, store lead, auditor, IT, co-workers with firsthand knowledge.
Digital forensics: disk images, hash values, access logs, email headers.
CCTV: clip extraction memo noting camera ID, time frame, and custodian; keep the originals; provide viewing copies.
Fact matrix: allegation-by-allegation mapping to exhibits and witness statements.

VII. Privacy, searches, and CCTV

Data Privacy Act principles: transparency, legitimate purpose, proportionality.
CCTV: post notices; restrict access to a need-to-know basis; retain only as long as necessary; log viewing/export.
Bag/locker checks: rely on published policy and consent (e.g., as part of employment conditions); conduct respectfully, same-gender where practicable, with witnesses; avoid intrusive body searches.
Device and email reviews: limit to business-owned assets or where policy gives the employer the right to audit; preserve only work-related data and minimize personal data exposure.

VIII. Wage deductions, fines, and restitution

General rule: Wage deductions require legal basis or the employee’s written authorization for a lawful and reasonable purpose.
No arbitrary fines unless part of a lawful, published disciplinary policy consistent with labor standards.
Restitution for losses may be pursued through:
- voluntary repayment agreements or quitclaims (must be knowing, voluntary, and for reasonable consideration),
- civil actions for damages, or
- criminal complaints (which may result in restitution orders).
Avoid coercion; document negotiations; consider installment terms where appropriate.

IX. Contractors and subsidiaries

If the person is an employee of a contractor (e.g., third-party merchandiser/guard), coordinate with the contractor:
- Request pull-out and administrative action by the contractor.
- The principal may still pursue criminal or civil remedies.
- Review the service agreement for indemnity and evidence-sharing clauses.

X. Unionized workplaces

Follow the CBA grievance procedure and just-cause standards.
Coordinate with shop stewards; ensure required union notices (without compromising the investigation).
Arbitrary bypass of the CBA process can invalidate discipline even with strong evidence.

XI. Interaction with criminal proceedings

Parallel but independent: Administrative dismissal can proceed independent of a criminal case.
Acquittal ≠ automatic reinstatement: Administrative cases require only substantial evidence.
When filing a complaint: prepare a case brief, attach certified copies of key exhibits, and identify witnesses for the prosecutor.

XII. Common pitfalls that lose cases

Vague NTEs (“you stole something sometime”).
No real opportunity to be heard (e.g., 24-hour deadline with voluminous records).
Overreliance on hunches: lack of documentary corroboration.
Preventive suspension used as a penalty or extended without pay/justification.
Public shaming; forcing “admissions.”
Withholding final pay without legal basis.

XIII. Practical controls to prevent theft

Policy & training: clear anti-pilferage rules; scenario-based refreshers.
Segregation of duties: cashiering vs. refund approvals; dual custody for safes.
System controls: exception reports, POS flags, least-privilege access.
Inventory discipline: cycle counts, blind counts, gate-pass enforcement.
Whistleblowing channels: confidential reporting; anti-retaliation stance.
Vendor/contractor controls: background checks where lawful; badge management.
Data loss prevention: device encryption, email DLP, removable-media controls.
CCTV governance: placement, retention, and audit trails.

XIV. Templates (adapt and localize)

A. Notice to Explain (excerpt)

Subject: Notice to Explain – Alleged Pilferage on 03 Oct 2025
Body:
1. Specific acts alleged (time, location, item value).
2. Rules violated (cite handbook provisions).
3. Summary of evidence (CCTV clip IDs, POS logs).
4. You are given five (5) calendar days to submit a written explanation.
5. You may attend a conference on [date/time] and submit evidence or witness names.

B. Preventive Suspension Memo (excerpt)

States the serious and imminent threat and scope/duration (up to 30 days), and clarifies it is not a penalty.

C. Decision Notice (excerpt)

Findings of fact; legal grounds (e.g., serious misconduct/LOTC); dismissal effective [date]; clearance/final pay processing instructions; how to claim personal effects.

XV. Quick employer checklist

Secure evidence, revoke risky access, log custody.
Conduct fact-finding; prepare a fact matrix.
Issue NTE with ≥ 5 days to respond.
Hold conference/hearing; document minutes.
Issue reasoned decision (and, if needed, preventive suspension).
Process final pay/clearance lawfully; consider restitution paths.
Decide on criminal referral; compile a case brief.
Close out with control improvements and staff training.

XVI. Frequently asked questions

Q1: Can we dismiss on “loss of trust” without catching the employee red-handed? Yes, provided you have substantial evidence of a willful work-related breach that makes continued employment untenable—especially for fiduciary/managerial roles—and you follow due process.

Q2: If the employee is acquitted criminally, do we have to reinstate? Not automatically. Administrative and criminal standards differ; a solid administrative record can stand despite acquittal.

Q3: Can we deduct the value of stolen goods from wages? Only if authorized by law or by the employee in writing for a lawful, reasonable purpose, and never in a way that violates minimum-wage or wage-protection rules.

Q4: How long can we keep CCTV footage and investigation files? Only as long as necessary for the purpose (investigation, litigation defense) and in line with your privacy notices/retention policy.

XVII. Final notes

Build every case as if it will be reviewed by a Labor Arbiter: facts organized, evidence preserved, due process observed.
Keep investigations respectful and proportionate; balance property protection with employee rights.
Periodically audit your policies (handbook, CCTV notice, device-use rules, disciplinary matrix) to ensure they’re current and consistently enforced.

This article is for general information. For complex or high-stakes cases, consult Philippine labor counsel to tailor the process to your facts and your sector.