Quick answer

A Philippine employer may investigate suspected employee fraud, dishonesty, or falsification of company records. If dismissal is being considered, however, suspicion alone is not enough. The employer must establish a lawful ground under Article 297 of the Labor Code through substantial evidence and substantially observe procedural due process.

For a just-cause dismissal, the usual minimum process is:

Preserve and objectively examine the records.
Give the employee a detailed written notice of the charge.
Allow at least five calendar days from receipt to submit an explanation.
Provide a meaningful opportunity to answer the evidence; hold a conference when legally or contractually required.
Decide impartially on the complete record.
If dismissal is justified, serve a separate written decision explaining the established ground.

Falsification can support dismissal for fraud, willful breach of trust, serious misconduct, or an analogous cause, depending on the employee’s position, the nature of the record, intent, company rules, and surrounding facts. It does not automatically justify dismissal in every case. Honest errors, negligence, disputed authorship, unreliable audit findings, and unauthorized assumptions must be distinguished from intentional deception.

These rules principally concern private-sector employment. Government personnel are governed by civil-service disciplinary rules and any applicable special law.

What the employer must prove

Article 297 of the Labor Code permits termination for, among other grounds:

serious misconduct connected with the employee’s work;
fraud or willful breach of the trust reposed by the employer;
commission of specified crimes or offenses against the employer or certain related persons; and
causes analogous to the grounds listed in the law.

The employer carries the burden of proving that a dismissal was valid. The required level is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion. It is lower than proof beyond reasonable doubt, but it still requires more than accusation, rumor, conjecture, or a bare declaration that management has “lost confidence.”

For fraud or willful breach of trust, the evidence should establish an actual, work-related and intentional or blameworthy act. A willful breach is committed knowingly and purposely, without a justifiable excuse; it is different from mere carelessness or an inadvertent mistake. Loss of confidence must be genuine, supported by facts, and not manufactured as a pretext for an improper dismissal. These principles are discussed in Gomez v. CrossWorld Marine Services, Inc. and Caoile v. National Labor Relations Commission.

When falsified records may amount to a just cause

Potentially relevant records include time sheets, attendance logs, payroll or reimbursement documents, receipts, inventory records, sales reports, customer forms, medical certificates, approvals, digital entries, audit confirmations, and electronic signatures.

Dismissal may be justified when substantial evidence shows, for example, that the employee knowingly:

fabricated, altered, backdated, concealed, or caused the alteration of a material company record;
entered false information to obtain money, credit, leave, commissions, benefits, or another advantage;
forged a signature or represented that an approval had been given when it had not;
manipulated attendance, payroll, inventory, accounting, sales, or transaction data;
submitted or used a document known to be false;
directed another person to create a false entry; or
concealed a shortage or unauthorized transaction through false records.

The Supreme Court has recognized that deliberate falsification of work records can constitute dishonesty, fraud, or serious misconduct. For example, it treated falsification of time cards as a potentially valid just cause in Reno Foods, Inc. v. Nagkakaisang Lakas ng Manggagawa–Katipunan. But every case remains document- and fact-specific.

The employer should still determine:

who actually created or altered the record;
whether the employee knew the entry was false;
whether the employee intended to mislead;
whether the record was material to the employee’s duties or the employer’s operations;
whether anyone obtained or attempted to obtain a benefit;
whether the employee occupied a position of trust;
whether the applicable rule was known, clear, and consistently enforced; and
whether dismissal is proportionate under the circumstances.

A false entry is not necessarily intentional falsification. Data-entry mistakes, confusing forms, faulty systems, incorrect instructions, shared credentials, unauthorized access, or a reasonable reliance on information supplied by another person may materially change the result.

Positions of trust and confidence

Loss of trust and confidence most commonly applies to:

managerial employees who exercise significant management powers; and
employees who routinely handle substantial company money or property, such as cashiers, auditors, property custodians, and employees with comparable fiduciary responsibilities.

The employee must hold a position in which the particular trust allegedly breached was actually reposed. An employer cannot simply label every worker a “confidential employee” to avoid proving the required connection.

The Supreme Court has also distinguished between managerial and rank-and-file employees. For rank-and-file employees, mere uncorroborated accusations are insufficient; proof of involvement in the questioned acts is required. The applicable principles are explained in Mabeza v. National Power Corporation and Panuncillo v. CAP Philippines, Inc..

A defensible investigation process

1. Secure the evidence without deciding guilt in advance

Preserve the original condition of relevant physical and electronic records. Consider securing:

original forms and attachments;
audit trails and system logs;
access and change histories;
relevant emails and business messages;
CCTV footage, subject to lawful retention and privacy rules;
accounting, payroll, attendance, inventory, and transaction records;
written policies and proof that the employee received them;
witness accounts based on personal knowledge; and
documents showing custody, approval, or handover.

Record who collected each item, when it was collected, where it came from, and whether it was copied or altered. Preserve native electronic files and metadata when authenticity or timing may be disputed. Avoid editing an original file merely to highlight relevant entries; work from a copy.

Access controls may be changed to preserve evidence, but investigators should not destroy data, seize personal property without authority, impersonate the employee, or access private accounts merely because they are reachable from a company device.

2. Conduct a neutral preliminary assessment

Before issuing a notice to explain, identify:

the specific questioned transaction or document;
the date, amount, account, customer, or system entry involved;
the employee’s actual role and authority;
the policy or duty allegedly breached;
evidence pointing toward and away from responsibility; and
possible innocent or technical explanations.

Audit findings should be checked against source records. A spreadsheet summary, discrepancy, or unsigned incident report is not necessarily enough by itself to prove who acted or with what intent.

Where practical, separate the complainant, investigator, and final decision-maker. Anyone with a personal conflict should disclose it and avoid controlling the outcome.

3. Serve a detailed first written notice

If the employer is considering termination, the first notice—often called a notice to explain or charge memorandum—should state:

the specific just cause under Article 297;
the particular company rule, if any, allegedly violated;
a detailed narration of the acts or omissions charged;
relevant dates, transactions, documents, amounts, and circumstances;
why the conduct may constitute fraud, falsification, dishonesty, or breach of trust;
that dismissal is among the possible consequences, if that is genuinely under consideration; and
the deadline and method for submitting an explanation.

A generic accusation such as “fraud,” “dishonesty,” or “loss of trust” does not adequately tell the employee what must be answered.

The employee must receive a reasonable period of at least five calendar days from receipt of the notice to study the charge, consult a lawyer or union officer, gather records, and prepare a defense. This standard appears in DOLE Department Order No. 147-15 and is reproduced in the Supreme Court’s decision in Bicol Isarog Transport System, Inc. v. Mirano.

Keep proof of service. If personal delivery is refused, document the refusal and use another verifiable method allowed by applicable rules or company policy.

4. Give a meaningful opportunity to answer

The employee should be allowed to submit an explanation and supporting evidence, identify witnesses, dispute authenticity or context, and address the employer’s material evidence.

Labor due process ordinarily requires a meaningful opportunity to be heard, not a courtroom trial. A formal hearing or conference becomes mandatory when:

the employee requests one in writing;
substantial factual or evidentiary disputes exist;
a company rule, collective bargaining agreement, or established practice requires it; or
comparable circumstances make a conference necessary for a fair evaluation.

This rule is discussed in Perez v. Philippine Telegraph and Telephone Company.

At a conference:

state the charge clearly;
allow the employee to answer each material point;
permit reasonable assistance by counsel or a union representative when requested;
identify the documents discussed;
avoid coercive demands for a confession or resignation; and
prepare accurate minutes and allow corrections to material inaccuracies.

If new and materially different accusations arise, issue a supplemental notice and allow another adequate opportunity to respond. A dismissal decision should not rely on a charge the employee was never asked to answer.

5. Evaluate all explanations and evidence

The decision-maker should test whether the evidence establishes:

authenticity and authorship;
intent or knowledge;
the employee’s duty and authority;
materiality of the alleged falsehood;
connection to the employee’s work;
actual or attempted benefit or concealment;
reliability of witness statements;
consistency with system records and audit trails; and
comparable treatment of similar cases.

An employee’s silence or incomplete response does not automatically prove fraud. The employer must still establish the charge through substantial evidence.

Likewise, an acquittal or dismissal of a criminal complaint does not automatically determine the labor case. Criminal and employment proceedings use different standards and may examine different issues. The administrative decision must stand on the evidence properly considered in the workplace investigation.

6. Select a proportionate response

Possible outcomes include:

closure of the investigation for insufficient evidence;
correction of records or controls;
counseling or retraining;
a penalty under a valid and consistently applied code of discipline;
a final warning or suspension, when appropriate and lawful; or
dismissal for a proven just cause.

Length of service and a clean record may be relevant, but they do not automatically excuse serious dishonesty. Conversely, the existence of a “dismissible offense” in a handbook does not eliminate the need to prove the act, examine intent, and observe due process.

The employer should check the employment contract, code of discipline, collective bargaining agreement, and past treatment of comparable cases. Selective or retaliatory enforcement can undermine the legitimacy of the decision.

7. Serve a separate written decision

If dismissal is warranted, the second written notice should:

identify the established facts;
state that the employee’s explanation and evidence were considered;
specify the applicable Article 297 ground and company rule;
explain why the evidence supports the conclusion;
state the effective date of termination; and
address final-pay and clearance arrangements without conditioning lawful payments on an invalid waiver.

Do not issue the decision before genuinely considering the employee’s response. A pre-signed or predetermined dismissal notice may indicate that the hearing opportunity was meaningless.

Preventive suspension during the investigation

Preventive suspension is not an automatic response to an accusation and should not be used as punishment.

Under the Omnibus Rules Implementing the Labor Code, an employee may be preventively suspended only when continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. For a records-falsification investigation, this may be relevant where the employee retains access that creates an immediate risk of altering evidence, diverting funds, manipulating accounts, or damaging company property—but the threat should be documented, not merely assumed.

Preventive suspension for one alleged offense generally may not exceed 30 days. After that, the employer must:

reinstate the employee to the former or a substantially equivalent position; or
extend the suspension while paying the wages and benefits due during the extension.

An indefinite or improperly prolonged unpaid suspension can amount to constructive dismissal. The governing limits are quoted and applied in Every Nation Language Institute v. Dela Cruz and Maula v. Ximex Delivery Express, Inc..

Less restrictive measures may sometimes be sufficient, such as temporary reassignment, dual approval, restricted system privileges, monitored access, or preservation of relevant accounts.

Privacy and confidentiality

Workplace investigations may involve personal information belonging to the accused employee, witnesses, customers, and other workers. The Data Privacy Act of 2012 requires lawful, fair, transparent, legitimate, and proportionate processing.

Employers should:

identify a lawful basis for collecting and using the data;
limit collection to material information;
restrict access to investigators and decision-makers with a genuine need to know;
use secure storage and transmission;
avoid circulating accusations in group chats or to uninvolved personnel;
redact unrelated personal or sensitive information where possible;
preserve information only as long as necessary under lawful retention requirements; and
follow applicable privacy notices, policies, security rules, and breach-response procedures.

Consent is not the only possible legal basis for processing personal information, but an internal investigation is not a blanket license to collect everything. Monitoring and review of employee communications must remain lawful, necessary, and proportionate. The Supreme Court discusses the Data Privacy Act’s application to employee computer monitoring in Cadajas v. People.

Confidentiality also protects the integrity of the investigation. It should not be used, however, to prevent an employee from obtaining lawful advice, consulting a union representative, reporting an offense to authorities, or exercising a statutory right.

If you are the employee under investigation

Act promptly and keep communications professional.

Note the date and method by which each notice was received.
Read the exact charge, company rule, transaction, and deadline.
Ask in writing for clarification or material documents if the notice is too vague to answer intelligently.
Preserve lawful copies of your notices, responses, policies, time records, approvals, messages, and relevant system records.
Do not alter, delete, conceal, or fabricate any record.
Prepare a chronological, fact-specific written explanation.
Identify technical errors, shared access, missing approvals, inconsistent records, or persons with direct knowledge.
Request a conference in writing if important factual disputes require one.
Ask to be assisted by a lawyer or union representative where appropriate.
Do not sign a confession, resignation, quitclaim, or waiver you do not understand.
If placed on preventive suspension, record its start date, stated basis, pay status, and any extension.

Never take trade secrets, customer databases, or unrelated confidential records merely to build a defense. Preserve only material that you may lawfully possess, and obtain legal advice if access or ownership is uncertain.

If you are conducting the investigation for the employer

Use a written case file or investigation log containing:

the allegation and how it was received;
preservation actions and access restrictions;
an inventory of evidence;
interview dates and reliable summaries;
notices and proof of service;
the employee’s response and attachments;
conference minutes;
conflicts disclosed by investigators;
credibility and authenticity findings;
the applicable policy and proof of communication;
comparable disciplinary cases, where relevant; and
the reasoned recommendation and final decision.

Keep the investigation focused. Mixing unrelated performance complaints into a fraud case without proper notice creates confusion and may deny the employee a fair opportunity to respond.

Common mistakes

Mistakes by employers

Treating an audit discrepancy as conclusive proof of fraud.
Accusing the employee in broad terms without dates, transactions, or documents.
Giving fewer than five calendar days to explain.
Counting the response period from the notice date instead of receipt.
Requiring an immediate written confession.
Relying on anonymous or hearsay accusations without corroboration.
Ignoring evidence that points to a system error or another user.
Deciding the penalty before receiving the explanation.
Denying a written request for a hearing despite substantial factual disputes.
Imposing preventive suspension without a serious and imminent threat.
Leaving an unpaid preventive suspension in force beyond 30 days.
Publicly disclosing the accusation.
Using evidence obtained through disproportionate or unlawful monitoring.
Dismissing for “loss of trust” when the employee did not occupy a qualifying position of trust.
Basing the decision on new charges absent from the first notice.

Mistakes by employees

Ignoring the notice or deadline.
Giving a purely emotional denial without addressing individual transactions.
Altering files or asking witnesses to coordinate stories.
Relying only on the absence of a criminal conviction.
Resigning under pressure without understanding the consequences.
Signing inaccurate minutes without noting objections.
Taking confidential company data unrelated to the defense.
Failing to preserve proof of service, suspension dates, and communications.

Consequences of getting the process wrong

A dismissal requires both:

substantive due process—a valid and proven cause; and
procedural due process—the required notices and meaningful opportunity to be heard.

If no just cause is proven, the dismissal may be illegal, potentially exposing the employer to reinstatement, backwages, and other relief depending on the case.

If a just cause is proven but the employer failed to observe statutory procedural due process, the dismissal may remain valid but the employer can be ordered to pay nominal damages. In Agabon v. National Labor Relations Commission, the Supreme Court fixed nominal damages at ₱30,000 for a just-cause dismissal implemented without the required process. Awards ultimately depend on the governing law and the court’s application to the case; employers should not treat this amount as a fee for bypassing due process.

When legal help is urgent

Seek advice from a Philippine labor lawyer, the employee’s union, DOLE, or the NLRC promptly when:

a response deadline is about to expire;
the notice alleges a large financial loss, forgery, theft, or a possible crime;
police, prosecutors, the NBI, or another regulator is involved;
the employee is being asked to surrender a personal device or password;
privileged, medical, financial, or sensitive personal information is involved;
dismissal or forced resignation appears imminent;
preventive suspension approaches or exceeds 30 days;
the employee has been barred from returning to work;
retaliation, discrimination, union activity, or whistleblowing may be involved;
the evidence may be deleted under an automatic retention schedule; or
a collective bargaining agreement provides a grievance or arbitration deadline.

An employee who believes that a dismissal was illegal may seek assistance through DOLE’s dispute-resolution mechanisms or file the appropriate case before the NLRC. According to the NLRC’s official FAQ, an illegal-dismissal action generally prescribes in four years from accrual. Related money claims may have a shorter period, so delay is risky. Current filing and procedural requirements should be confirmed through the NLRC or the relevant regional office.

Frequently asked questions

Must the employer wait for a criminal conviction?

No. A workplace case and a criminal case are separate proceedings with different purposes and standards of proof. The employer may decide an administrative case on substantial evidence, but it cannot rely solely on the existence of a criminal complaint.

Is an actual hearing always required?

No. A meaningful written opportunity to answer may satisfy labor due process. A formal hearing or conference is required when the employee requests one in writing, substantial evidentiary disputes exist, company rules or practice require it, or comparable circumstances justify it.

How long must the employee be given to explain?

At least five calendar days from receipt of the first written notice. More time may be appropriate when records are extensive, access is delayed, or other circumstances make the minimum inadequate.

Can the employer immediately suspend the employee?

Only preventive suspension justified by a serious and imminent threat to life or property may be imposed under the governing rule. It is not an automatic penalty for being accused. An unpaid preventive suspension for one offense generally cannot exceed 30 days.

Does falsification always justify dismissal?

No. The employer must prove the act, the employee’s responsibility and the required intentional or blameworthy character. Materiality, position, work connection, company rules, prior record, proportionality, and mitigating or aggravating circumstances may matter.

Is financial loss required?

Not necessarily. Deliberate falsification or breach of a position of trust may be serious even when a loss was prevented. The absence of loss, however, can remain relevant to materiality, intent, and proportionality.

Can an employee be dismissed for another person’s false entry?

Not merely because the entry was made within the employee’s area of responsibility. The employer must establish the employee’s own participation, authorization, knowing use, concealment, or other blameworthy breach through substantial evidence.

May the employee have a lawyer or union representative?

An employee should be given a reasonable opportunity to consult a lawyer or union official while preparing a defense. Assistance at a conference may be requested, subject to applicable law, the collective bargaining agreement, and valid procedures.

What if the employee refuses to receive the notice or submit an explanation?

The employer should document valid service or the refusal. After a genuine opportunity and adequate period have been provided, the employer may decide on the available evidence. Refusal or silence does not relieve the employer of proving the charge.

May the employer report the matter to the police or a prosecutor?

Yes, when the facts may constitute a crime, but a criminal complaint should be based on responsibly preserved evidence and handled separately from the employment decision. Filing a complaint does not establish guilt and does not replace labor due process.

Official legal references

This article provides general legal information, not legal advice, and cannot determine the outcome of a particular investigation. Employment contracts, collective bargaining agreements, company rules, the employee’s position, and the actual records may change the analysis. Sources and current procedural points were checked as of August 28, 2026.