If you suspect an employee stole company money, inventory, equipment, or customer payments in the Philippines, the most important first step is not to “file a qualified theft case” immediately. It is to build a clean, documented, legally usable record showing what was taken, who had access, why the taking was unauthorized, and why the employee’s position involved a special trust that was gravely abused. Qualified theft is a serious criminal charge, but many employer complaints fail because they rely on anger, suspicion, audit shortcuts, or a police blotter instead of evidence that meets the legal elements of the crime.

What Qualified Theft Means in the Philippines

Under Article 308 of the Revised Penal Code, theft is committed when a person, with intent to gain, takes the personal property of another without consent, and without violence, intimidation, or force upon things. (Lawphil)

Theft becomes qualified theft under Article 310 when it is committed under special circumstances, including when it is committed:

by a domestic servant;
with grave abuse of confidence;
or involving certain property or situations listed in Article 310.

Article 310, as amended by Batas Pambansa Blg. 71, punishes qualified theft by penalties two degrees higher than simple theft under Article 309. (Supreme Court E-Library)

In employee theft cases, the usual theory is qualified theft by grave abuse of confidence. This means the employee did not merely steal; the employee allegedly used a position of special trust to make the theft possible.

Qualified Theft Is Not Automatic Just Because the Suspect Is an Employee

A common mistake is assuming that every theft by an employee is automatically qualified theft. It is not.

The Supreme Court has repeatedly emphasized that grave abuse of confidence must be proven separately. In Balagtas v. People (G.R. No. 257483, October 30, 2024), the Court explained that the prosecution must first establish a relationship of confidence between the offended party and the accused. The trust must be special or of a higher degree, not merely the ordinary trust that exists in every employment relationship. (Supreme Court E-Library)

This matters in real cases. A cashier, payroll officer, collector, warehouse custodian, accounting staff, inventory controller, purchasing officer, or branch manager may have access to company property. But access alone is not always enough. The complaint should show:

what specific property or money was entrusted to the employee;
the employee’s job function and authority;
how the employee’s position gave them the opportunity to commit the taking;
why the employer relied on that employee in a special way;
how the employee gravely exploited that trust.

If the evidence proves theft but not grave abuse of confidence, the case may be downgraded to simple theft, with abuse of confidence treated only as an aggravating circumstance. The Supreme Court said this clearly in Balagtas, where it found that taking advantage of one’s position does not automatically prove qualified theft. (Supreme Court E-Library)

Elements You Must Prove for Qualified Theft Against an Employee

For qualified theft based on grave abuse of confidence, the evidence must show:

There was taking of personal property. This may involve cash, goods, inventory, tools, equipment, company devices, customer payments, fuel, supplies, or other movable property.
The property belonged to another. The complainant may be the employer, corporation, sole proprietor, partnership, client, or another person whose property was in the employer’s custody.
The taking was done with intent to gain. Intent to gain does not always mean resale or cash profit. It may include personal use, withholding, unauthorized appropriation, or any benefit derived from the property.
The taking was without the owner’s consent.
There was no violence, intimidation, or force upon things. If violence, intimidation, or force upon things was used, the proper charge may be robbery, not theft.
The taking was done with grave abuse of confidence. This is the qualifying element that turns ordinary theft into qualified theft. The Supreme Court listed these elements in Balagtas v. People and other cases applying Articles 308 and 310 of the Revised Penal Code. (Supreme Court E-Library)

Qualified Theft vs. Estafa: Why the Difference Matters

Employee misappropriation cases are often confused with estafa under Article 315 of the Revised Penal Code. The difference usually depends on the type of possession the employee had.

The Supreme Court has explained that when an employee receives money on behalf of the employer, the employee usually has only material possession, not juridical possession. Juridical possession means a legal right over the property that the holder may assert even against the owner. If the employee merely receives funds as a cashier, collector, branch staff, or company representative, the misappropriation may be theft or qualified theft, not estafa. (Supreme Court of the Philippines)

In Reside v. People (G.R. No. 210318), a school principal who collected tuition payments and failed to remit them was held liable for qualified theft rather than estafa because she had only material possession of the funds. The Court explained that conversion of property by an employee with only material possession constitutes theft, while misappropriation by an agent with both material and juridical possession may constitute estafa. (Supreme Court E-Library)

Practical examples:

Situation	Possible case	Why
Cashier pockets sales collections	Qualified theft or theft	Cashier usually has material custody for the employer
Collector receives customer payments and fails to remit	Qualified theft or theft	Funds are received on behalf of the company
Agent receives goods on commission with authority to deal with them independently	Estafa may be considered	Agent may have juridical possession depending on the agreement
Employee falsifies liquidation reports and keeps advances	Estafa, theft, falsification, or a combination may be considered	Depends on documents, authority, and manner of misappropriation
Payroll officer pads payroll and pockets excess funds	Qualified theft may be considered	Position may involve special trust over payroll processing

Step-by-Step Guide to Filing Qualified Theft Charges Against an Employee

1. Secure the evidence before confronting the employee

Before issuing accusations, preserve the evidence. Many cases weaken because records are overwritten, CCTV footage expires, logs are edited, or inventory is mixed with later transactions.

Secure:

CCTV footage and backup copies;
POS logs, cash register reports, and Z-readings;
inventory records, stock cards, delivery receipts, and withdrawal slips;
official receipts, invoices, collection reports, and deposit slips;
bank statements and online payment records;
payroll records and timekeeping logs;
system access logs and audit trails;
chat messages, emails, and written instructions;
employment contract, job description, company policies, and accountability forms.

Keep original files where possible. For digital records, save export copies and screenshots, but also preserve the original system data. Record who extracted the files, when they were extracted, and where they were stored.

2. Conduct an internal fact-finding investigation

A criminal complaint should be based on facts, not suspicion. The employer should identify:

the exact amount or items lost;
the period covered;
the employee’s assigned duties;
the employee’s access rights;
who else had access;
what records connect the employee to the missing property;
whether the shortage may be explained by error, spoilage, system issues, or other employees’ acts.

For companies, it is usually best to assign a small fact-finding team: operations, finance/accounting, HR, and a document custodian. Avoid spreading accusations in the workplace because unnecessary publication can create defamation, labor, privacy, or morale issues.

3. Prepare a written incident report and audit report

The audit report should be understandable to a prosecutor who does not know your business. Avoid vague conclusions like “employee stole money.” Instead, state the facts clearly.

A strong report usually includes:

the employee’s position and duties;
normal process flow;
what should have happened;
what actually happened;
discrepancies found;
documents reviewed;
computation of loss;
identity of persons who prepared and verified the report;
attachments supporting each finding.

If the case involves inventory, attach itemized schedules. If it involves money, include a clean reconciliation table.

4. Observe labor due process separately

The criminal case is separate from the employee’s administrative or labor case.

Under Article 297 of the Labor Code, an employer may terminate employment for just causes such as serious misconduct, fraud, willful breach of trust, or commission of a crime against the employer or its representative. (Labor Law PH Library)

However, even if the employer plans to file a criminal complaint, it should still observe labor due process before dismissal. In practical terms, this usually means:

issue a Notice to Explain stating the specific acts complained of;
give the employee a fair chance to respond and submit evidence;
conduct a hearing or conference when necessary;
evaluate the response and evidence;
issue a written decision or notice of termination if warranted.

Do not treat the filing of a criminal complaint as a substitute for labor due process. A dismissal may still be challenged before the NLRC even if a criminal complaint is pending.

5. Do not unlawfully withhold wages or force repayment

Employers often want to deduct the alleged loss from the employee’s salary, final pay, commissions, or 13th month pay. Be careful.

Philippine labor law generally restricts wage deductions. The Labor Code prohibits unauthorized deductions from wages, subject only to limited exceptions such as those authorized by law or written authorization in proper cases. It is also unlawful to withhold wages without the worker’s consent through force, intimidation, threat, or similar means. (Alburo Law Offices)

If the employee voluntarily offers restitution, document it properly. But avoid coercive documents such as forced promissory notes, blank waivers, or confessions signed under threat of detention. These can damage both the criminal and labor aspects of the case.

6. Prepare the complaint-affidavit

The complaint-affidavit is the main sworn statement filed with the prosecutor. It should be executed by the offended party or an authorized representative.

For a company, the affiant is usually:

the owner or sole proprietor;
president, general manager, or branch head;
finance manager, audit head, HR manager, or other officer with personal knowledge;
authorized representative under a board resolution or secretary’s certificate.

The complaint-affidavit should state:

the full name and address of the complainant;
the full name and last known address of the employee;
the employment relationship;
the employee’s position and duties;
the property or money taken;
the date, place, and manner of taking;
the evidence showing lack of consent;
the evidence showing intent to gain;
the facts showing grave abuse of confidence;
the exact amount of loss, if known;
list of attachments and witnesses.

Avoid exaggeration. Prosecutors and courts usually respond better to a precise, document-backed complaint than to a highly emotional accusation.

7. File with the proper Office of the Prosecutor

Qualified theft complaints are commonly filed with the City Prosecutor’s Office or Provincial Prosecutor’s Office where the offense was committed. A police report or blotter can help document the initial incident, but a blotter by itself is not the criminal case.

Under the 2024 DOJ-NPS Rules on Preliminary Investigations and Inquest Proceedings, the complaint-affidavit is filed with the relevant prosecution office and should be accompanied by the investigation data form and supporting evidence. The complaint is screened for sufficiency in form and completeness of evidence before docketing. (Global Litigation News)

The Department of Justice’s own checklist for filing a complaint for preliminary investigation includes the NPS Investigation Data Form, complaint-affidavit or sworn statement, and supporting affidavits and documents. (doj.gov.ph)

8. Attend the preliminary investigation

A preliminary investigation is not yet the trial. It is the prosecutor’s process for determining whether the case should be filed in court.

In practice, the prosecutor may:

require the complainant to submit missing evidence;
issue subpoenas to the respondent-employee;
require the respondent’s counter-affidavit;
allow clarificatory hearings;
require additional documents;
dismiss the complaint;
or issue a resolution finding sufficient basis to file an Information in court.

Under the current DOJ-NPS framework, prosecutors apply a stronger screening approach focused on whether the evidence establishes a prima facie case with reasonable certainty of conviction. (Global Litigation News)

9. If the prosecutor finds basis, the case proceeds to court

If the prosecutor finds sufficient basis, an Information is filed in court in the name of the People of the Philippines. An Information is the formal criminal charge signed by the prosecutor and filed with the court.

The complaint or Information must properly allege the qualifying circumstance. Under Rule 110 of the Revised Rules of Criminal Procedure, the complaint or Information must state the acts complained of, the designation of the offense, and the qualifying and aggravating circumstances. (Supreme Court E-Library)

This is important. If grave abuse of confidence is not properly alleged and proven, the court may not treat the case as qualified theft even if the employer believes the employee abused trust.

Required Documents for Filing Qualified Theft Against an Employee

Document	Purpose	Practical notes
Complaint-affidavit	Main sworn complaint	Must be notarized or sworn before authorized officer
Witness affidavits	Support the facts	Use witnesses with personal knowledge
NPS Investigation Data Form	Required by prosecution offices	Usually available at the prosecutor’s office
Employment contract or appointment papers	Proves employment and position	Include job description if available
Company ID, HR record, or payroll record	Identifies respondent as employee	Helps establish role and access
Job description and accountability forms	Shows special trust or custody	Very important for grave abuse of confidence
Audit report	Explains the shortage or loss	Should be itemized and supported
Receipts, invoices, POS reports, stock cards	Proves property or money involved	Organize chronologically
CCTV footage and screenshots	Shows acts or access	Preserve original files and storage device
System logs or access reports	Links user account to transactions	Identify who extracted the logs
Demand letter or notice to explain	Shows employer acted formally	Demand is not always an element of theft, but may help show lack of authority and opportunity to explain
Board resolution or secretary’s certificate	Authority for company representative	Needed when complainant is a corporation

Fees and Timelines in Practice

The exact fees and timing vary by city, province, workload, and case complexity. The DOJ publishes schedules of fees for criminal complaints, and prosecution offices may assess filing or legal research-related fees depending on the complaint category and local implementation. (doj.gov.ph)

Stage	Typical timeline	Common bottlenecks
Internal audit and evidence gathering	1–4 weeks	Incomplete records, overwritten CCTV, unclear inventory controls
Drafting affidavits and attachments	3 days–2 weeks	Witnesses unavailable, unsigned reports, lack of authority documents
Filing and docketing at prosecutor’s office	Same day to several weeks	Incomplete attachments or need for additional evidence
Preliminary investigation	2–6 months or longer	Postponements, counter-affidavits, clarificatory hearings, heavy docket
Prosecutor resolution	Several weeks to several months	Case volume and complexity
Court proceedings after Information is filed	Months to years	Arraignment, pre-trial, witness availability, court docket

Do You Need Barangay Conciliation First?

For most qualified theft cases, barangay conciliation is usually not the proper route because the offense carries penalties beyond the barangay justice threshold. Supreme Court Circular No. 14-93 lists as excluded from Katarungang Pambarangay offenses punishable by imprisonment exceeding one year or a fine over ₱5,000. (Lawphil)

Also, if the complainant is a corporation, the dispute may fall outside ordinary barangay conciliation requirements because a juridical entity is involved. Still, for very small workplace disputes, local prosecutors or police may ask about barangay proceedings depending on the facts. When in doubt, ask the prosecutor’s office where the complaint will be filed.

Special Notes for Foreign Employers, Expats, and Overseas Owners

Foreigners and overseas Filipino business owners can file or support qualified theft complaints in the Philippines, but documentation matters.

If the business owner or key witness is abroad:

execute a detailed affidavit before a Philippine consulate, if available;
or sign before a foreign notary and have the document apostilled if the country is an Apostille Convention country;
attach passport or government ID copies;
issue a Special Power of Attorney if a Philippine representative will file and follow up;
for corporations, prepare board authority or equivalent company authorization.

The Philippines became a party to the Apostille Convention on May 14, 2019, replacing the old “red ribbon” process for documents covered by the Convention. (Apostille Services)

If the foreign document comes from a non-Apostille country, consular legalization may still be needed. Always check the receiving prosecutor’s office or court because documentary practice can vary, especially for affidavits executed abroad.

Common Mistakes That Weaken Qualified Theft Complaints

Filing based only on suspicion

A shortage does not automatically prove theft. The complaint must connect the employee to the taking.

Weak allegation: “Only Anna was on duty, so she must have stolen the cash.” Stronger allegation: “Anna was the cashier assigned to register No. 2 from 1:00 p.m. to 9:00 p.m.; POS log user ANNA02 processed voids totaling ₱48,500; CCTV at 7:42 p.m. shows her removing cash from the drawer after the void transaction; the cash count report and deposit slip confirm the shortage.”

Failing to prove grave abuse of confidence

The complaint must show why the employee’s role involved special trust. Attach the job description, accountability forms, authority to receive money, key custody forms, system access rights, or written policies.

Overcharging every missing item as qualified theft

If inventory discrepancies occurred over months with many employees having access, the prosecutor may see the case as speculative. Break down the losses by date, transaction, item, and responsible person.

Coercing a confession

A forced confession, threat of detention, public shaming, or pressure to sign a blank promissory note can create serious problems. It may also give the employee defenses in both the criminal and labor case.

Ignoring labor due process

Even when theft is strongly suspected, the employer should still follow proper employee discipline procedures. The criminal case and employment termination process are separate.

Waiting too long

Under Article 91 of the Revised Penal Code, prescription generally starts from the day the crime is discovered by the offended party, authorities, or their agents, and is interrupted by the filing of the complaint or Information. (Lawphil)

Delay can also cause practical evidence problems: witnesses resign, CCTV is overwritten, system logs are purged, and memories fade.

Can Settlement Stop a Qualified Theft Case?

Restitution can affect the practical handling of the case, but it does not automatically erase criminal liability.

Article 23 of the Revised Penal Code states that pardon by the offended party does not extinguish criminal action, except in specific cases provided by law; it may extinguish civil liability only if the offended party expressly waives it. (Lawphil)

In practical terms:

the employer may accept restitution;
the employer may execute an affidavit of desistance;
the prosecutor may still proceed if evidence supports the charge;
the court is not automatically bound by settlement;
civil liability may be affected by waiver, payment, or compromise.

For employers, settlement documents should be carefully drafted. For employees, payment should not be treated as an automatic admission unless the document clearly says so.

Frequently Asked Questions

Can I file qualified theft against an employee without CCTV?

Yes. CCTV is helpful but not required. The Supreme Court has recognized that direct evidence is not always necessary and that circumstantial evidence may support conviction if the proven circumstances logically establish guilt beyond reasonable doubt. (Supreme Court E-Library)

Useful non-CCTV evidence includes audit reports, POS logs, receipts, inventory records, access logs, witness affidavits, bank records, and admissions.

Is a police blotter enough to charge an employee with qualified theft?

No. A police blotter only records that an incident was reported. To pursue criminal charges, you generally need a complaint-affidavit and supporting evidence filed with the prosecutor’s office or handled through law enforcement referral.

Can I immediately arrest an employee I suspect of stealing?

Not simply because you suspect them. Warrantless arrests are allowed only under specific legal circumstances, such as when the person is caught in the act or other recognized situations under criminal procedure. In most employee theft cases discovered through audit, the safer route is evidence preservation, police report if needed, and filing with the prosecutor.

What if the employee already resigned?

Resignation does not prevent the filing of a criminal complaint. It may make evidence gathering and service of subpoenas harder, so preserve the last known address, contact details, employment records, IDs, and exit documents.

What if the employee offers to pay everything back?

Payment may help recover losses, but it does not automatically extinguish criminal liability. Put any restitution agreement in writing, issue proper receipts, and avoid coercion. If a criminal complaint has already been filed, the prosecutor or court may still evaluate the public offense separately from the private settlement.

Can I deduct the stolen amount from the employee’s final pay?

Be careful. Wage deductions and withholding are restricted under Philippine labor law. Unauthorized deductions can expose the employer to labor claims even if the employer believes the employee stole money. Use a properly documented voluntary agreement or pursue recovery through the criminal case’s civil aspect or a separate civil action.

Should I file theft, qualified theft, or estafa?

It depends on the facts. If the employee had only material possession of company money or property, theft or qualified theft is often considered. If the person had juridical possession, such as an agent or administrator with legal authority over the property, estafa may be considered. Prosecutors look at the actual relationship, documents, and authority—not just the job title.

How long does a qualified theft case take in the Philippines?

The prosecutor stage may take a few months or longer, depending on the completeness of evidence, number of respondents, counter-affidavits, and docket congestion. If the case reaches court, trial may take months to years. Good documentation at the start can significantly reduce delay.

Can a corporation file qualified theft charges?

Yes. A corporation usually acts through an authorized representative, supported by a secretary’s certificate, board resolution, or written authority. The representative should have access to company records and be able to explain the facts or identify the employees who prepared the audit.

What happens if grave abuse of confidence is not proven?

The case may be dismissed, or the charge may be treated as simple theft if the elements of theft are otherwise proven. The penalty and legal consequences can change significantly because qualified theft carries penalties two degrees higher than simple theft.

Key Takeaways

Qualified theft is theft plus a qualifying circumstance, usually grave abuse of confidence in employee cases.
An employee’s status alone does not automatically make the crime qualified theft.
The complaint must prove the taking, ownership, lack of consent, intent to gain, absence of violence or force, and grave abuse of confidence.
Preserve records early: CCTV, POS logs, audit reports, receipts, inventory records, access logs, and witness affidavits.
File a sworn complaint-affidavit with the proper prosecutor’s office, supported by complete documents.
Handle the labor case separately by observing notice, opportunity to explain, and a written decision.
Do not rely on a police blotter alone, and do not force confessions or unlawful salary deductions.
Restitution may help recover losses but does not automatically erase criminal liability.