Quick answer
An employer in the Philippines may investigate suspected employee fraud or falsified records and, if the evidence warrants it, impose discipline up to dismissal. But a finding that a document is false is not, by itself, proof that the accused employee falsified it, and an internal investigation cannot be used merely to formalize a decision that management has already made.
For a just-cause dismissal, the employer must establish a valid ground under Article 297 of the Labor Code by substantial evidence and must separately observe procedural due process. In general, that means a detailed first written notice, at least five calendar days from receipt for the employee to prepare a written explanation, a meaningful opportunity to be heard, and a written decision if termination is ultimately imposed. A formal hearing is not required in every case, but it becomes mandatory when the employee requests one in writing, substantial evidentiary disputes exist, company rules or practice require it, or similar circumstances justify one. (Department of Labor and Employment)
Fraud, deliberate falsification, manipulation of company records, concealment of transactions, false expense claims, fabricated attendance records, or similar conduct may support dismissal in appropriate cases. The correct result, however, depends on what the employee actually did, the evidence connecting the employee to the act, the employee's duties and authority, the applicable company rules, the seriousness and work connection of the conduct, and the procedure followed by the employer.
This discussion primarily addresses private-sector employment governed by the Labor Code. Government personnel, and some workers subject to special employment regimes or collective bargaining agreements, may have additional or different procedural rules.
Start with the correct legal ground
Article 297 of the Labor Code permits an employer to terminate employment for, among other grounds, serious misconduct and fraud or willful breach of the trust reposed in the employee. An employee who is dismissed without a valid just or authorized cause may be entitled to the remedies for illegal dismissal provided by law. (Department of Labor and Employment)
Department Order No. 147-15 gives more specific standards. For fraud or willful breach of trust, there must be an act, omission, or concealment involving a breach of a legal duty, trust, or confidence justly reposed in the employee; it must be committed against the employer or its representative; and it must be connected with the employee's work. (eLibrary)
The same rules treat loss of confidence with particular caution. The employee must occupy a position of trust and confidence, the conduct must genuinely justify the loss of trust, and the asserted loss of confidence cannot be simulated, used as a pretext for an improper cause, or invented after the fact to justify an earlier decision. Positions of trust generally include managerial employees and fiduciary rank-and-file employees who routinely handle significant amounts of money or property. The Supreme Court has emphasized that the actual nature of the work—not merely the job title—determines whether the position is one of trust and confidence. (eLibrary)
Depending on the facts, deliberate falsification may also be analyzed as serious misconduct. For misconduct to justify dismissal, it must be grave or aggravated, connected with the employee's work, and indicative of unfitness to continue working for the employer. Mere error in judgment or an inadvertent mistake is not automatically serious misconduct. (eLibrary)
The employer should therefore identify the precise theory of the case rather than simply writing “fraud,” “dishonesty,” or “loss of trust” on a notice.
A false record does not automatically identify the falsifier
This distinction is especially important in investigations involving altered records.
In San Miguel Corporation v. NLRC (Ibias), the employee's medical consultation card indisputably contained falsified entries. The Supreme Court nevertheless held that the employer failed to establish by substantial evidence that the employee himself made the unauthorized entries. The applicable company rule punished falsification, not mere possession of a falsified document. (eLibrary)
That principle has broad practical significance. An investigation should distinguish among very different acts: creating a false record, altering an authentic record, instructing another person to alter it, knowingly submitting or using a false record, concealing a falsification, approving a transaction known to be false, and simply possessing or being associated with a record later shown to contain inaccurate information.
Those acts may have different evidentiary and legal consequences. Management should not infer authorship merely because the document benefited the employee or was found in the employee's possession unless other evidence reasonably connects the employee to the falsification.
The employer bears the burden of proving a valid dismissal
When dismissal is challenged, the employer bears the burden of proving that the termination was based on a valid cause. The required standard in a labor case is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion. Suspicion, speculation, or an accusation unsupported by sufficient facts is not enough. (Lawphil)
This is less demanding than proof beyond reasonable doubt in a criminal case, but it remains a real evidentiary burden. An employer cannot prevail merely because the employee's explanation appears weak; the employer's own evidence must adequately establish the misconduct relied upon.
For loss of trust and confidence, the requirement is particularly important because the ground is inherently susceptible to subjective use. The Supreme Court repeatedly requires an actual factual basis for the loss of trust rather than the employer's whim, suspicion, or after-the-fact assertion. (eLibrary)
A sound investigation should separate fact-finding from the decision to dismiss
The Labor Code's twin-notice procedure applies to termination for just cause. It does not prevent an employer from first conducting a neutral preliminary audit or fact-finding inquiry to determine whether there is a genuine case to answer.
That preliminary stage is often essential in fraud cases. Records may need to be secured before they disappear, transaction histories reconciled, system access reviewed, witnesses identified, and alternative explanations tested.
The important point is that preliminary fact-finding should remain fact-finding. Management should not treat the notice to explain as a ceremonial step after guilt and dismissal have already been decided. Due process requires a genuine opportunity for the employee's explanation and evidence to affect the outcome. (eLibrary)
A defensible investigation will ordinarily proceed as follows:
Preserve the relevant evidence first. Secure original documents, native electronic files, audit trails, version histories, system logs, approval records, CCTV footage where lawfully available, relevant emails or work messages, accounting records, access-control records, and other materials before routine deletion or alteration occurs. Preserve potentially exculpatory evidence as well as evidence supporting the accusation.
Define the exact suspected act. Identify what was allegedly created, changed, concealed, submitted, approved, or used; when it happened; the transaction or record involved; and how the employee is allegedly connected to it.
Test authorship and access. Determine who could create or alter the record, who possessed credentials or physical access, whether credentials could have been shared, whether entries were automatically generated, whether another employee could have made the change, and whether ordinary clerical or system errors offer a plausible explanation.
Match the facts to the legal and company-rule ground. Decide whether the potential case concerns fraud or willful breach of trust, serious misconduct, another Article 297 ground, or a specific company rule. Do not use “loss of confidence” reflexively if the employee does not actually occupy a position of trust and confidence.
Issue a sufficiently specific first written notice if dismissal is being considered. Describe the material facts, transactions, dates, records, acts or omissions, the applicable Article 297 ground, and relevant company policies. Give the employee at least five calendar days from receipt to submit a written explanation.
Meaningfully consider the defense. Review documents and witnesses identified by the employee. Conduct a hearing or conference when legally required or when necessary to resolve substantial factual disputes. Permit the employee to have a representative if desired.
Give notice of materially new accusations before relying on them. If the investigation uncovers a different material act that was not fairly included in the original charge, the employee should be informed and allowed to respond before that new accusation is used as a basis for dismissal.
Decide the case on the complete record. Determine whether substantial evidence establishes the exact offense charged, taking into account the employee's role, intent, work connection, company rules, seriousness of the act, and material defenses.
If dismissal is justified, issue the second written notice. The termination notice should communicate that the circumstances and the employee's explanation were considered and that the grounds relied upon have been established. Preserve the investigation file and proof of service.
What the first notice to explain must contain
Department Order No. 147-15 requires considerably more than a memo saying that an employee is being investigated for “dishonesty” or “fraud.”
The first written notice must identify the specific Article 297 ground and applicable company policies, if any; provide a detailed narration of the facts and circumstances forming the charge; and direct the employee to submit a written explanation within a reasonable period. A general description is expressly insufficient. The reasonable period is at least five calendar days from receipt, allowing the employee time to study the accusation, consult or be represented by a lawyer or union officer, gather evidence, and decide on defenses. (eLibrary)
In a falsification case, useful specificity normally includes the document or electronic record involved, the disputed entry or representation, the approximate date or transaction, the employee's alleged participation, why the entry is considered false, and the policy or legal ground allegedly violated.
The notice need not read like a criminal Information, but it must tell the employee enough to make an intelligent defense.
An employer that gives only 24 or 48 hours to answer a dismissible charge risks violating the five-calendar-day standard. The Supreme Court has rejected abbreviated periods that did not provide the required reasonable opportunity. (eLibrary)
Do not add a new dismissal ground only in the final decision
A recurring due-process problem occurs when an employee answers one accusation, but the employer later dismisses the employee for another.
The purpose of the first notice is to permit the employee to answer the particular acts or omissions actually being relied upon. Supreme Court decisions have rejected attempts to rely on charges that were not included in the notice and to which the employee therefore had no opportunity to respond. (eLibrary)
If genuinely new evidence uncovers a materially different offense during the investigation, the safer and fairer course is to issue an additional or supplemental notice describing that accusation and give the employee an adequate opportunity to answer before relying on it.
A final termination notice should not be the first time the employee learns of a decisive allegation.
Is an administrative hearing always required?
No.
Philippine labor due process requires an ample opportunity to be heard, not necessarily a courtroom-style trial. The opportunity may be written or verbal and may take the form of a hearing, conference, or another fair and reasonable procedure. (eLibrary)
A formal hearing or conference becomes mandatory, however, when the employee requests it in writing, when substantial evidentiary disputes exist, when a company rule or established practice requires it, or when similar circumstances justify one. (eLibrary)
Fraud and falsification investigations frequently involve contested authorship, disputed system access, contradictory witnesses, or questions about the authenticity of records. Where those disputes are substantial, an employer should not assume that receiving a written explanation alone will always suffice.
Company policies and a collective bargaining agreement also matter. If the employer's own disciplinary rules promise a particular hearing, grievance procedure, appeal, or other safeguard, the employer may be bound to follow that procedure even if the statutory minimum would otherwise be less demanding. (eLibrary)
Evidence worth preserving in a fraud or falsification investigation
The strongest investigation file ordinarily preserves the evidence in the form in which it existed when the issue was discovered. For electronic cases, a screenshot alone may not tell the full story. Native records, timestamps, audit logs, database histories, access logs, account identifiers, metadata, approval chains, and system-generated histories may help distinguish the person who created a record from the person who merely viewed, printed, approved, or possessed it.
For paper records, retain originals when possible and document where they came from. Relevant comparison documents, specimen signatures, voucher packets, receipts, inventory records, time records, leave records, accounting entries, and approval forms may be important.
The employer should also preserve the operative employee handbook, code of conduct, employment terms, relevant memoranda, and collective bargaining provisions in force when the alleged conduct occurred. If the disciplinary decision relies on a company rule, the actual rule and its applicability may become material in a later labor case.
Witness interviews should focus on personal knowledge rather than conclusions such as “I know he committed fraud.” Record what the witness actually observed, when it occurred, what system or document was involved, and how the witness knows the fact being asserted.
The objective is not to build the largest possible file. It is to preserve reliable evidence that proves—or disproves—the precise charge.
Preventive suspension is not automatic in a fraud case
An accusation of fraud does not automatically authorize unpaid preventive suspension.
Under the Labor Code's implementing rules, preventive suspension is proper only when the employee's continued employment presents a serious and imminent threat to the life or property of the employer or co-workers. Preventive suspension is protective, not punitive. (eLibrary)
A genuine risk may exist, for example, when the employee under investigation continues to have substantial access to funds, inventory, sensitive financial records, or systems that could be altered or used to affect property. Whether that reaches the legal standard depends on the actual circumstances, not merely on the label “fraud.”
An initial preventive suspension may not exceed 30 days. After that period, the employer must reinstate the employee to the former or a substantially equivalent position, or may extend the suspension only if wages and other benefits are paid during the extension. The Supreme Court has warned that allowing a preventive suspension to exceed the permissible period without reinstatement or proper extension can result in constructive dismissal. (eLibrary)
For that reason, preventive suspension should not be used simply to remove an accused employee from the workplace while an investigation remains unfinished indefinitely.
Respect data privacy while gathering evidence
An internal fraud investigation does not suspend the Data Privacy Act.
Republic Act No. 10173 requires personal-data processing to comply with transparency, legitimate purpose, and proportionality. Information should be relevant and not excessive for the purpose, processed fairly and lawfully, appropriately secured, and retained only as long as justified by the applicable purpose or lawful need. Legitimate interests may provide a lawful basis for certain processing, subject to the employee's fundamental rights and freedoms. (Privacy Commission)
The National Privacy Commission has likewise explained that employers may, in appropriate circumstances, monitor activity on company-issued equipment pursuant to legitimate interests, but they should be transparent about monitoring, assess necessity and proportionality, maintain clear policies, and avoid excessively intrusive methods where less intrusive measures will accomplish the legitimate purpose. (Privacy Commission)
This means an employer investigating suspected falsification should distinguish between legitimately reviewing company records, company systems, corporate email, or properly governed workplace monitoring and indiscriminately searching private accounts, personal devices, or unrelated personal information.
Where sensitive personal information, privileged communications, private devices, or data obtained from third parties are involved, the lawful basis and scope of access should be reviewed carefully before collection or disclosure.
Common mistakes that weaken an employer's case
Treating an accusation as proof. A report from a supervisor, customer, auditor, or co-worker may justify investigation, but it does not eliminate the employer's burden to establish the charge by substantial evidence.
Assuming that the beneficiary falsified the record. The existence of a false record and the identity of the person who created or knowingly used it are separate factual questions. San Miguel v. Ibias is a clear reminder of that distinction. (eLibrary)
Sending a vague notice to explain. “Explain why you should not be terminated for dishonesty” is not a substitute for the detailed factual narration required by Department Order No. 147-15. (eLibrary)
Giving less than five calendar days. The period is counted from receipt of the first notice and must ordinarily be at least five calendar days. (eLibrary)
Using a hearing merely to confirm a predetermined outcome. Due process requires a meaningful opportunity for the employee's defense to be considered.
Relying on uncharged misconduct in the termination letter. A material new ground should not appear for the first time after the employee has lost the opportunity to answer it. (eLibrary)
Calling every employee a position of trust. Loss of trust and confidence has specific requirements. The employee's actual duties and control over money, property, or confidential managerial matters matter more than a convenient job title. (eLibrary)
Automatically imposing preventive suspension. There must be a serious and imminent threat to life or property, and the 30-day rule must be observed. (eLibrary)
Ignoring the company's own disciplinary procedure. A handbook, CBA, or established company practice may require safeguards beyond the statutory minimum. (eLibrary)
Conducting an unnecessarily intrusive digital search. Investigative necessity does not erase privacy and proportionality requirements. (Privacy Commission)
What an employee should do after receiving a notice to explain
Record the exact date the notice was received because the response period ordinarily runs from receipt. Read the factual allegations separately from the conclusions. Determine which transaction, document, entry, communication, or act the employer actually attributes to you.
Answer each material allegation factually. If you did not create or alter the disputed record, say so clearly and explain who had custody, system access, passwords, approval rights, or the ability to make the entry, if known. Identify records that can objectively verify your account.
Preserve your own lawful copies of relevant employment records, notices, explanations, policies, pay records, correspondence, and evidence. Do not delete, edit, manufacture, backdate, or “correct” records after an investigation has begun.
If important evidence is controlled by the employer, identify it specifically in the explanation and ask that it be considered. If there are substantial factual disputes, request a hearing or conference in writing. If you want a lawyer, union officer, or other permitted representative to assist you, communicate that request promptly.
If the employer later introduces a materially different accusation, state in writing that you have not yet been given an opportunity to answer that charge and request a reasonable opportunity to do so.
A criminal case and an employment case are separate
Some falsification or fraudulent-record cases may also raise possible criminal issues. Whether conduct constitutes falsification, estafa, theft, another offense, or no criminal offense at all depends on the particular document, act, intent, and statutory elements.
An employer does not generally need to obtain a criminal conviction before deciding a labor case. Labor cases use the substantial-evidence standard, whereas a criminal conviction requires proof beyond reasonable doubt. The Supreme Court has therefore recognized that even an acquittal in a related criminal case does not automatically prevent a finding that sufficient evidence existed for employment discipline. (eLibrary)
The reverse is equally important: an internal finding or the discovery of an inaccurate document does not automatically establish criminal guilt.
Where a criminal complaint is being considered, the exact offense and the preservation, acquisition, and presentation of evidence should be separately reviewed rather than treating the labor investigation as a substitute for criminal-law analysis.
What happens if there was a valid cause but defective procedure?
Substantive and procedural due process are separate questions.
If no just or authorized cause actually existed, the dismissal may be illegal, with the remedies provided by the Labor Code, including reinstatement and backwages when legally applicable. (Department of Labor and Employment)
If a valid just cause existed but the employer failed to observe the required statutory procedure, Agabon v. NLRC established that the procedural defect does not automatically erase an otherwise valid just-cause dismissal. The employer may instead be ordered to pay nominal damages for violating the employee's statutory due-process rights. Agabon fixed ₱30,000 in that case, and subsequent decisions have commonly applied that amount in just-cause dismissals, although the assessment of nominal damages ultimately belongs to the adjudicating tribunal based on applicable jurisprudence and circumstances. (eLibrary)
Employers should therefore avoid the mistaken view that due process is optional whenever the evidence of wrongdoing appears strong.
When legal help is urgent
Prompt legal review is particularly important when dismissal is already being considered but the notice to explain is vague or allows fewer than five calendar days; a preventive suspension is approaching or has passed 30 days without reinstatement or paid extension; the employer intends to rely on allegations that were never included in the notice; there is a serious dispute over who created or altered electronic records; evidence or system logs may soon be overwritten; the investigation involves personal devices, privileged communications, sensitive personal information, or covert monitoring; a criminal complaint is also being prepared; the employee is being pressured to resign or sign a quitclaim; or the applicable handbook or CBA contains a disciplinary procedure that has not been followed.
Early advice can matter because mistakes in evidence preservation and notice cannot always be repaired simply by producing a more detailed termination letter later.
If the dismissal or suspension is disputed
An employee may seek labor assistance through the Single Entry Approach or SEnA, subject to the governing rules and exceptions. DOLE issued revised SEnA rules through Department Order No. 249, series of 2025. DOLE's current Assistance and Referral Management System, or DOLE ARMS, provides an electronic Request for Assistance filing service. Unresolved disputes that fall within the jurisdiction of the Labor Arbiter may proceed through the appropriate NLRC process. (Department of Labor and Employment)
Do not assume that every monetary and dismissal claim has the same prescription period. The NLRC currently states that an illegal-dismissal action generally prescribes in four years from accrual, while ordinary money claims arising from employer-employee relations are generally subject to a three-year prescriptive period. Particular claims, contracts, grievance procedures, or circumstances can require separate analysis, so waiting until the end of those periods is risky. (National Labor Relations Commission)
FAQ
Can an employer investigate first before issuing a notice to explain?
Yes. A preliminary audit or fact-finding inquiry may be used to determine what happened and whether there is a sufficient basis to charge an employee. But if the employer proceeds toward dismissal for just cause, the required pre-termination notices and opportunity to be heard must be observed. The preliminary investigation cannot substitute for that process. (eLibrary)
Can an employee be dismissed immediately because an audit found a falsified record?
Not merely because the record is false. The employer must establish a valid just cause and sufficiently connect the employee to the conduct relied upon. A false document does not automatically establish who falsified it. (eLibrary)
Is the five-day response period five working days?
No. Department Order No. 147-15 states at least five calendar days from receipt of the first notice. (eLibrary)
Must every fraud investigation have a face-to-face hearing?
No. A meaningful written opportunity may satisfy the hearing requirement in an appropriate case. A formal hearing or conference becomes mandatory when requested in writing, when substantial evidentiary disputes exist, when company rules or practice require one, or when similar circumstances justify it. (eLibrary)
Can a first offense involving falsification result in dismissal?
Possibly, but there is no rule that every first accusation of falsification automatically warrants termination. The employer still has to establish a statutory just cause, the employee's actual participation and intent, the work connection and seriousness of the conduct, and the applicability of company rules. The appropriate result is fact-specific.
Can the employer use “loss of trust and confidence” for any employee?
No. When dismissal is based on loss of trust and confidence, the employee must occupy a genuine position of trust and confidence, judged principally by the actual nature of the employee's duties. (eLibrary)
What if the employee refuses to sign the notice?
Refusing to acknowledge receipt does not itself establish guilt. Department Order No. 147-15 provides that the required notices are to be served personally or at the employee's last known address. Employers should preserve reliable proof of service and continue to evaluate the case on its evidence. (eLibrary)
Does an employee have to be convicted of falsification before being dismissed?
No. An employment case generally requires substantial evidence rather than criminal proof beyond reasonable doubt. A criminal proceeding and an employment disciplinary proceeding have different purposes and evidentiary standards. (eLibrary)
Can an employer examine a company laptop or work account during the investigation?
Potentially, where the employer has a lawful basis and the processing complies with applicable policies and the Data Privacy Act. The investigation should remain transparent where required, necessary for a legitimate purpose, proportionate, and no more intrusive than reasonably justified. (Privacy Commission)
Official sources
DOLE — Labor Code of the Philippines, Renumbered DOLE Edition 2022
DOLE — Book Six: Post-Employment
Supreme Court E-Library — King of Kings Transport, Inc. v. Mamac
Supreme Court E-Library — Perez v. Philippine Telegraph and Telephone Company
Supreme Court E-Library — San Miguel Corporation v. NLRC (Ibias)
Supreme Court E-Library — Every Nation Language Institute v. Dela Cruz on preventive suspension
National Privacy Commission — Republic Act No. 10173, Data Privacy Act of 2012
DOLE — Revised SEnA Guidelines under Department Order No. 249, series of 2025
DOLE ARMS — Electronic SEnA Request for Assistance
General-information disclaimer
This article provides general Philippine legal information and is not a substitute for legal advice on a particular investigation, disciplinary case, termination, criminal complaint, collective bargaining agreement, or data-privacy issue. The legality of an employment decision depends on the actual evidence, the employee's duties, the applicable company rules or CBA, the notices served, and the procedure actually followed.
Sources checked for current law and procedure: 26 August 2026.