Quick answer

An employer may investigate suspected employee fraud or falsified records, secure company evidence, and impose discipline—including dismissal—when the facts justify it. But suspicion, an audit discrepancy, or an accusation alone is not enough.

For a dismissal based on fraud, dishonesty, serious misconduct, or willful breach of trust to withstand challenge, the employer generally must establish both:

Substantive due process: a lawful and sufficiently serious ground supported by substantial evidence; and
Procedural due process: a specific first written notice, a genuine opportunity to answer, and a written notice of the final decision.

The employee must normally receive at least five calendar days from receipt of the first notice to prepare a response. A formal hearing is not automatically required in every case, but it becomes necessary when the employee requests one in writing, substantial factual disputes must be resolved, company rules or a collective bargaining agreement require it, or comparable circumstances call for it.

An employer should investigate first and decide afterward. A notice to explain that already declares the employee guilty—or a termination announced before the response is fairly considered—undermines due process.

What conduct may justify dismissal?

Article 297 of the Labor Code permits termination for, among other just causes:

Serious misconduct connected with the employee’s work;
Fraud or willful breach of the trust placed in the employee; and
Causes analogous to the listed grounds.

Falsifying receipts, payroll entries, attendance records, reimbursement documents, inventory reports, delivery records, customer accounts, approvals, or other company records may fall under these grounds. The label placed on the offense is not decisive, however. The employer must prove what the employee actually did and why that conduct meets the legal ground charged.

Fraud or willful breach of trust

A willful breach is intentional, knowing, and purposeful—not merely careless, mistaken, or inadvertent. For loss of trust and confidence to justify dismissal, the employer should be able to show that:

The employee occupied a genuine position of trust and confidence;
A real and work-related act justified the loss of trust;
The breach was willful; and
The conclusion rests on established facts rather than rumor, speculation, or manufactured distrust.

Positions of trust commonly include managerial employees and rank-and-file personnel routinely entrusted with money, inventory, confidential records, accounts, or other company property. The standard is applied with particular care to rank-and-file employees: uncorroborated allegations ordinarily will not establish their participation.

Serious misconduct

An employer relying on serious misconduct should establish that the conduct:

Was serious rather than trivial;
Related to the employee’s work and showed unfitness to continue working; and
Was performed with wrongful intent.

Not every inaccurate entry is fraud. A typographical error, misunderstanding, weak internal control, shared password, defective system, unclear instruction, or negligent recordkeeping may require correction or another proportionate sanction without necessarily proving intentional falsification.

A company-rule violation is not automatically a lawful dismissal

The employer should identify the actual rule violated and show that it was valid, reasonable, applicable, and made known to the employee. The language of the rule matters. For example, a rule prohibiting a knowingly false statement should not automatically be stretched to cover an omission if its text does not fairly do so.

Dismissal must also be proportionate to the proven offense. Relevant considerations may include the employee’s duties, intent, actual or potential harm, participation, past disciplinary record, length of service, consistent enforcement, and mitigating circumstances. A long record of service does not excuse fraud, but neither should an employer mechanically impose the maximum penalty for an unproven or minor irregularity.

The correct investigation process

1. Secure evidence without deciding guilt

Once a credible concern arises, the employer should preserve the relevant records and prevent alteration or loss. Appropriate measures may include:

Restricting access to affected accounts, systems, cash, inventory, or files;
Preserving original paper and electronic records;
Recording when, where, and from whom each item was obtained;
Exporting audit logs in a manner that retains timestamps and metadata;
Identifying who had access to the relevant system or credentials;
Separating original evidence from working copies; and
Documenting each investigative step.

Access restrictions should be targeted. They should not be used to humiliate the employee, announce guilt, or pressure the employee to resign.

Personal information collected during the investigation must be handled for a legitimate purpose, limited to what is relevant, kept secure, and disclosed only to persons who need it. Workplace investigations remain subject to the Data Privacy Act of 2012 and its implementing rules.

2. Conduct a neutral preliminary review

Before issuing charges, identify:

The questioned transaction or record;
The date, amount, account, document, or system involved;
The employee’s actual role and authority;
Other people who could create, approve, edit, or transmit the record;
The applicable written policy or procedure;
Evidence pointing toward and away from responsibility; and
Possible innocent explanations, including system or control failures.

Investigators should avoid leading witnesses, group interviews that contaminate recollections, selective preservation, or conclusions based only on unsigned summaries. Witness statements should be dated and should distinguish personal knowledge from information learned from someone else.

3. Serve a detailed first written notice

If the preliminary review discloses a sufficient factual basis, the employer should issue a notice to explain or charge memorandum. It should contain:

A detailed narration of the material acts or omissions;
Relevant dates, transactions, documents, amounts, and circumstances;
The employee’s alleged participation;
The specific company rules allegedly violated;
The applicable just cause or causes under Article 297;
A statement that dismissal is among the possible consequences, if it truly is;
Instructions for submitting a written explanation;
A response period of at least five calendar days from receipt; and
Information about any scheduled conference and the employee’s opportunity to request one.

A generic accusation such as “fraud,” “dishonesty,” or “falsification of records” is insufficient if it leaves the employee guessing which transaction or conduct must be answered.

The notice should not describe guilt as already established. It may state that the employee is being required to answer allegations supported by identified preliminary evidence.

4. Give meaningful access and time to respond

The response opportunity must be real, not ceremonial. Subject to legitimate confidentiality and privacy limits, the employer should identify or provide access to records material to the defense. The employee should be allowed to:

Submit a written explanation and supporting documents;
Identify witnesses or other persons with relevant access;
Explain workflows, authorizations, system limitations, or shared controls;
Challenge the authenticity, completeness, or interpretation of evidence;
Request relevant records held by the employer;
Consult a union officer or lawyer; and
Request a hearing or conference in writing.

If necessary material is disclosed late, or the case is unusually complex, a reasonable extension should be considered. The five-day rule is a minimum opportunity to prepare, not a license to withhold evidence until the deadline is nearly over.

Failure to submit an explanation after proper notice may allow the employer to decide on the available evidence, but it does not transform an unsupported accusation into proof.

5. Hold a hearing when required

A courtroom-style trial is generally unnecessary. A fair administrative conference can be sufficient if the employee can understand the evidence, answer the accusations, and present a defense.

A hearing or conference should be held when:

The employee requests it in writing;
Important facts are genuinely disputed;
Witness credibility must be assessed;
Company rules, established practice, or a CBA requires it; or
Similar circumstances make written submissions inadequate.

Minutes should accurately record who attended, the issues discussed, documents presented, requests made, and any agreed deadlines. The employee should be allowed to correct material inaccuracies in the record.

Representation by a lawyer is not automatically indispensable in every internal investigation, but the employee must have a reasonable opportunity to consult one. Union-membership and CBA rights should be checked separately.

6. Evaluate all the evidence impartially

The decision-maker should assess inculpatory and exculpatory evidence, not merely adopt an investigator’s accusation. The employer bears the burden of proving a valid dismissal by substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support the conclusion.

Useful questions include:

Is the questioned record authentic and complete?
Who created, edited, approved, or benefited from it?
Were credentials shared or controls weak?
Do system logs reliably identify a person rather than only a device or account?
Is intent proved, or is the conduct equally consistent with error or negligence?
Are witness accounts based on personal knowledge and corroborated?
Does the employee’s explanation fit the objective records?
Was the same rule consistently applied to comparable employees?
Is dismissal proportionate to the proven conduct?

The employer should not rely exclusively on the accusation of an interested person when objective records are reasonably available.

7. Issue a reasoned second written notice

After considering the employee’s explanation and the investigation record, the employer must give written notice of the decision. If dismissal is imposed, the notice should:

Identify the allegations that were proven and those that were not;
Summarize the material evidence relied upon;
Address the employee’s significant defenses;
State the company rule and statutory ground applied;
Explain why the conduct warrants dismissal rather than a lesser penalty; and
State the effective date of termination and any internal review procedure.

The second notice must reflect an actual post-response evaluation. It should not introduce a materially new charge that the employee never had an opportunity to answer. If new evidence creates a different accusation, the safer course is to give supplemental notice and another meaningful opportunity to respond.

Preventive suspension is limited

Preventive suspension is not an advance penalty. It may be used only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers.

In a suspected fraud case, it may be justified when continued access creates a serious and imminent risk to funds, inventory, vital records, or evidence. The employer should document the particular threat instead of assuming that every fraud allegation permits suspension.

A preventive suspension for one offense generally may not exceed 30 days. After that period, the employer must ordinarily:

Reinstate the employee to the former or a substantially equivalent position; or
Extend the suspension while paying the wages and benefits due during the extension.

An unsupported, excessively long, or indefinite suspension may result in salary liability and, depending on the circumstances, a claim of constructive dismissal. Temporary reassignment or limited system access may sometimes address the risk more proportionately, provided these measures are lawful and not punitive or degrading.

Internal discipline and criminal proceedings are separate

An employer does not need to obtain a criminal conviction before imposing lawful discipline. Labor and criminal proceedings use different standards:

An employment decision must be supported by substantial evidence and comply with labor due process.
A criminal conviction requires proof beyond reasonable doubt and the protections of criminal procedure.

Accordingly, the filing, dismissal, or outcome of a criminal complaint does not automatically determine the labor case. Conversely, an internal finding does not establish criminal guilt.

If the employer is considering referral to law enforcement, it should preserve original records and obtain advice about evidence handling, affidavits, corporate authority, and the elements of the possible offense. The internal notice should not threaten criminal prosecution merely to force a resignation, admission, repayment, or waiver.

Evidence each side should preserve

For the employer

Preserve:

Original questioned records and authenticated copies;
Audit trails, access logs, version histories, and relevant metadata;
Written policies and proof that they were communicated;
Job descriptions, authority matrices, and approval workflows;
The complaint or incident report;
Interview notes and signed witness statements;
Notices, proof of service, replies, and hearing minutes;
Records of evidence disclosed or requested;
The investigator’s report and decision record;
Documents showing consistent treatment of comparable cases; and
Payroll and preventive-suspension records.

Do not alter the original document to add annotations. Work from a marked copy and retain the original intact.

For the employee

Preserve lawfully obtained copies of:

The notice to explain, attachments, and proof of receipt;
The written response and proof of submission;
The termination or suspension notice;
Relevant emails, instructions, approvals, and work procedures;
Records showing who had access to the account, device, form, or files;
Requests for evidence, extensions, or a hearing;
Hearing notes and the names of attendees;
Payslips, contract, handbook, CBA, and disciplinary policy; and
Messages or documents suggesting retaliation, unequal treatment, or a predetermined decision.

An employee should not delete, alter, conceal, or take confidential records unrelated to the defense. When access to company information is disputed, request the material in writing and seek legal advice before copying it.

Common mistakes

Mistakes by employers

Terminating first and investigating afterward;
Giving a vague notice that merely says “fraud” or “dishonesty”;
Allowing fewer than five calendar days from receipt to answer;
Withholding the substance of the evidence while demanding a detailed defense;
Treating silence or refusal to confess as proof of guilt;
Relying on rumor, anonymous claims, or an audit discrepancy without corroboration;
Ignoring evidence that other employees had access;
Equating negligence or error with intentional falsification;
Using preventive suspension as punishment;
Keeping the employee suspended without pay beyond 30 days;
Adding new grounds only in the termination notice;
Applying policies selectively;
Pressuring the employee to resign or sign a waiver; and
Publicly identifying the employee as a fraudster before the facts are resolved.

Mistakes by employees

Ignoring the notice or missing the response deadline;
Giving only a blanket denial when specific facts can be addressed;
Altering, deleting, or concealing records;
Using company or customer data for unrelated purposes;
Signing an admission, resignation, or quitclaim without understanding it;
Failing to request material records or a hearing in writing;
Assuming that no criminal case means dismissal is impossible; and
Waiting too long to seek assistance after suspension or termination.

If due process is violated

The consequence depends on whether a valid cause is ultimately proven.

No valid cause: The dismissal may be illegal, potentially resulting in reinstatement and full back wages, subject to the facts and final adjudication.
Valid just cause but defective procedure: The dismissal may remain valid, but prevailing Supreme Court doctrine generally allows ₱30,000 in nominal damages for denial of statutory due process in a just-cause dismissal.
Unlawful preventive suspension: The employee may be entitled to wages for an unjustified suspension or for an unpaid extension beyond the permitted period, depending on the circumstances.

These are not automatic outcomes. Relief depends on the pleadings, evidence, employment status, and rulings of the labor tribunals or courts.

When legal help is urgent

Prompt advice is especially important when:

A response deadline is about to expire;
The notice is vague or the employer refuses access to material evidence;
Preventive suspension is nearing or has exceeded 30 days;
The employee is being pressured to resign, confess, repay money, or sign a quitclaim;
Evidence may be deleted, overwritten, or altered;
Significant funds, customer data, regulated records, or multiple employees are involved;
A criminal complaint, warrant, subpoena, or law-enforcement interview is possible;
The allegation may involve retaliation, discrimination, union activity, or whistleblowing;
Management involved in the accusation is also controlling the investigation; or
The termination decision has already been served.

Employees may seek assistance through the Department of Labor and Employment’s Single Entry Approach or the appropriate NLRC Regional Arbitration Branch. The NLRC website provides its SEnA e-Request facility, contact details, and the 2025 NLRC Rules of Procedure.

As a general limitation period, illegal-dismissal claims prescribe in four years, while many money claims arising from employment prescribe in three years. Filing a request for assistance under SEnA may toll the applicable period under the current NLRC rules. Employees should not treat those outer limits as a reason to delay: records and witnesses can disappear, and procedural deadlines after a labor ruling can be much shorter.

Frequently asked questions

Can an employee be dismissed immediately after fraud is discovered?

Not merely because management believes fraud occurred. The employer may promptly secure property and evidence and, when legally justified, impose preventive suspension. Dismissal should follow only after a specific charge, a meaningful opportunity to answer, and a fair evaluation.

Must the employer prove the exact financial loss?

Not always. Intentional falsification or a willful breach of trust may be serious even if the loss was prevented or is difficult to quantify. The employer must still prove the employee’s conduct, intent, work connection, and the legal basis for the penalty.

Is an admission required?

No. A case may be established through reliable documents, logs, witness testimony, and other substantial evidence. An admission obtained through coercion is dangerous to rely upon and may raise separate legal issues.

Is five calendar days always enough?

It is the minimum generally recognized for preparing an explanation. A longer period may be reasonable when records are extensive, evidence is disclosed late, the employee has a documented inability to respond, or company rules or a CBA provide more time.

May the employee have a lawyer or union officer present?

The employee must have a reasonable opportunity to consult a lawyer or union officer. Attendance during the internal conference depends on applicable company rules, the CBA, the circumstances, and the employee’s rights under relevant law. A written request should be made promptly.

Is a formal hearing required if the employee already submitted a written explanation?

Not automatically. It is required when requested in writing, when substantial evidentiary disputes exist, when company rules or practice require it, or when similar circumstances make a conference necessary for a fair opportunity to be heard.

Can the employer rely on CCTV, email, or system logs?

Yes, if lawfully obtained, relevant, authentic, complete, and fairly interpreted. A user account or device identifier may not by itself establish who performed an act, particularly where access was shared or security controls were weak. Privacy, security, and evidentiary integrity must also be observed.

What if the employee refuses to receive the notice?

The employer should document the attempted service and use a reliable method permitted by applicable rules and company policy. Refusal to receive a properly served notice does not necessarily stop the process, but the employer should retain clear proof of when and how service was attempted.

Does repayment erase the offense?

Not necessarily. Repayment may be relevant to mitigation but does not automatically erase a proven intentional fraud or breach of trust. It also should not be treated as an admission unless the circumstances clearly support that conclusion.

Can an employer investigate several employees together?

Yes, but each employee’s participation and defense must be evaluated individually. Group liability cannot replace evidence identifying who did what. Employees should receive notices specific enough to answer their own alleged conduct.

Official legal references

This article provides general legal information, not advice for a specific investigation or case. Employment contracts, company rules, collective bargaining agreements, the employee’s position, and the actual evidence may change the result. Official sources were last checked on August 2, 2026.