Quick answer

An employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. For a lawful termination in the Philippine private sector, the employer must establish both:

A valid substantive ground, supported by substantial evidence—such as fraud or a willful breach of trust under Article 297 of the Labor Code; and
Procedural due process—a specific written notice of charge, at least five calendar days from receipt to explain, a meaningful opportunity to be heard, and a written notice of the final decision.

Falsification is not automatically a dismissible offense in every case. The employer must prove the employee’s participation, dishonest or willful intent when the invoked ground requires it, the connection to the employee’s work or position of trust, and the proportionality of dismissal. A company rule declaring an offense punishable by dismissal does not eliminate these legal requirements.

This article principally covers private-sector employment. Government employees are governed by civil-service and agency disciplinary rules, which have different procedures and penalties. A collective bargaining agreement, employment contract, or valid company policy may also require additional safeguards.

What must be proved before dismissal

Employee fraud or falsification may fall under one or more just causes in Article 297 of the Labor Code, including:

Serious misconduct connected with the employee’s work;
Fraud or willful breach of the trust placed in the employee;
Commission of a crime or offense against the employer, specified family members, or the employer’s authorized representative; or
A cause truly analogous to the statutory grounds.

The label used by management is not controlling. The actual facts must satisfy the elements of the ground stated in the notice.

For fraud or willful breach of trust, the employer generally must show:

The employee occupied a position of trust and confidence;
There was an actual act or omission attributable to that employee;
The breach was willful and intentional, rather than a mere mistake or ordinary negligence;
The employer had a genuine, reasonable basis for losing trust; and
The charge was supported by substantial evidence.

Positions of trust can include managerial personnel and rank-and-file employees who routinely handle significant money or property, such as cashiers, auditors, and property custodians. For rank-and-file employees, mere accusation, association with a suspected transaction, or an unexplained discrepancy ordinarily does not prove personal participation. The Supreme Court discusses these distinctions in Bance v. University of St. Anthony and Jalit v. Philflex.

“Substantial evidence” means relevant evidence that a reasonable mind might accept as adequate to support a conclusion. It is less demanding than proof beyond reasonable doubt, but it still requires more than rumor, speculation, or a bare assertion. Once dismissal is shown, the employer bears the burden of proving its legality.

When falsified records may—or may not—justify dismissal

Potentially serious cases include intentionally altering time records to obtain unearned pay, fabricating receipts or reimbursements, changing inventory or accounting entries to conceal shortages, forging approvals, creating fictitious transactions, or knowingly submitting material false information to obtain employment or a benefit.

But the employer should not assume fraud merely because a record is wrong. The discrepancy may have resulted from:

Clerical error;
An unclear process or defective system;
Entries made by another person using shared credentials;
An authorized correction that was poorly documented;
Inadequate training;
Mistaken instructions;
Negligence without dishonest intent; or
A legitimate explanation supported by other records.

Materiality also matters. The investigation should determine what the altered information affected, whether the employee benefited, whether the act exposed the employer to loss or legal risk, and whether the employee attempted to conceal it. Actual financial loss can strengthen a charge, but its absence does not necessarily excuse a proven dishonest act.

A criminal conviction is not required before an employer may decide an administrative case. Conversely, an internal finding does not establish criminal guilt. Employment, civil, and criminal proceedings use different standards and should not be treated as interchangeable. The Supreme Court confirms that criminal guilt or innocence is not determinative of just cause in St. Luke’s Medical Center, Inc. v. Sanchez.

A fair investigation process

1. Secure the evidence without deciding guilt in advance

Identify the records, transactions, time period, systems, and employees genuinely within the inquiry. Preserve relevant materials before they can be overwritten or altered, including:

Original paper records and properly documented copies;
Accounting, payroll, inventory, access, and audit logs;
Emails and work-platform messages;
Approval histories and system metadata;
CCTV footage collected and retained under a lawful workplace policy;
Witness statements based on personal knowledge;
Applicable policies, manuals, job descriptions, and acknowledgment forms; and
Prior versions of the disputed document.

Record who collected each item, when it was collected, where it came from, and how it was stored. Retain original files when possible; do not rely only on screenshots or retyped summaries. For electronic records, preserve relevant metadata and maintain restricted, read-only copies.

The investigator should separate verified facts from assumptions. Any person who is a complainant, witness, or possible participant should not be the sole decision-maker if a reasonably independent reviewer is available.

2. Respect privacy and confidentiality

An investigation does not give unrestricted authority to search every personal account or device. Processing employee information must comply with the Data Privacy Act’s principles of transparency, legitimate purpose, and proportionality. Collect only information reasonably necessary for the defined investigation, limit access to personnel with a legitimate need to know, secure the records, and avoid unnecessary disclosure of the allegation.

Review company privacy notices, acceptable-use rules, device policies, and lawful bases before examining communications or devices. Personal accounts, private conversations, medical information, and unrelated third-party data require particular care. The governing principles appear in Republic Act No. 10173 and its implementing rules.

3. Use interim controls carefully

Management may temporarily change passwords, preserve records, require dual approvals, restrict access to particular systems, or reassign sensitive functions when reasonably necessary. These measures should be documented, limited to the actual risk, and applied without humiliation or a public declaration of guilt.

Preventive suspension without pay is allowed only when the employee’s continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. It is not an automatic response to every fraud allegation and is not a penalty.

Ordinarily, preventive suspension may not exceed 30 days. After that, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying wages and benefits. The employee need not reimburse pay received during an extension even if later dismissed. An unjustified or excessively prolonged suspension may lead to wage liability or constructive-dismissal issues. These limits are explained in Lagamayo v. Danish Connection.

4. Serve a legally sufficient notice to explain

The first written notice should contain:

The specific just cause or causes being considered under Article 297;
The exact company provisions allegedly violated, if applicable;
A detailed narration of the material facts;
The relevant dates, transactions, documents, amounts, and conduct attributable to the employee;
Enough information for the employee to understand and answer the evidence; and
A directive to submit a written explanation within a reasonable period.

A generic allegation such as “fraud,” “dishonesty,” “loss of trust,” or “falsification of records” is insufficient. The notice should not say that guilt has already been established or that dismissal is inevitable.

Under DOLE Department Order No. 147-15, a reasonable period means at least five calendar days from the employee’s receipt of the notice. This period allows the employee to study the charge, consult a lawyer or union officer, obtain evidence, and prepare a defense. A company should extend the period when fairness reasonably requires it, such as when records are voluminous or essential documents have not yet been made accessible.

Keep proof of service and receipt. The governing rule permits service personally or at the employee’s last known address.

5. Give a meaningful opportunity to be heard

The employee must be allowed to:

Give a written explanation;
Present supporting records and identify witnesses;
Challenge disputed records or their attribution;
Explain system access, shared credentials, or approval practices;
Raise procedural objections;
Request relevant information needed to answer the charge; and
Seek assistance from a representative, lawyer, or union officer, if desired.

A trial-type hearing is not required in every case. A formal hearing or conference becomes mandatory when:

The employee requests it in writing;
There are substantial evidentiary disputes;
Company rules or established practice require it; or
Similar circumstances make a hearing necessary for a fair evaluation.

When a hearing is held, prepare accurate minutes, list the attendees and exhibits, record requests or objections, and let the employee correct material errors in the minutes. Refusal to sign should be documented but should not be treated automatically as an admission.

If the employee does not respond despite proper notice and a real opportunity to do so, the employer may decide on the available evidence. Silence alone, however, is not proof of fraud.

6. Evaluate the charge impartially

Before deciding, the employer should answer each of these questions:

Is the disputed record authentic, and was it properly preserved?
Who created, changed, approved, transmitted, or benefited from it?
Could another person have made the entry?
Does the evidence establish intent, not merely error?
Is the act connected to the employee’s work?
Does the employee actually occupy the position of trust being invoked?
Were similarly situated employees treated consistently?
Was the rule communicated to the employee?
Does the employee’s explanation create a material unresolved conflict?
Is dismissal proportionate to the proven offense?

The decision should be based only on charges the employee had a fair opportunity to answer. If the inquiry discovers a materially different offense, issue a new or supplemental notice and allow another reasonable response period.

Company policies are relevant, but management cannot make dismissal automatically lawful merely by listing it as the prescribed penalty. Courts may still examine the gravity of the act, its work connection, the employee’s duties, intent, surrounding circumstances, prior record, consistency of discipline, and whether a lesser penalty would be proportionate.

7. Issue a reasoned written decision

If the employer concludes that dismissal is justified, the second written notice should state:

The charge or charges actually established;
The important evidence and explanation considered;
The factual findings;
The legal and company-policy grounds;
Why the defense was accepted or rejected;
Why dismissal is proportionate; and
The effective date of termination.

The decision must indicate that all relevant circumstances were considered and that grounds sufficient to end employment were established. Serve it personally or at the employee’s last known address and retain proof of service.

If the evidence does not establish just cause, close the case or impose only a lawful, proportionate lesser measure. Correct records and restore access, pay, or status affected by an unjustified interim action.

Rights and practical steps for the employee

An employee who receives a notice to explain should act promptly:

Note the exact date and manner of receipt.
Request a readable copy of the notice and identify unclear charges in writing.
Ask for relevant records reasonably needed to answer, without taking confidential materials unlawfully.
Preserve original emails, messages, approvals, schedules, receipts, and system notifications.
Identify shared passwords, delegated access, system faults, or other persons who handled the record.
Prepare a chronological, factual response addressing each allegation separately.
Attach copies of supporting evidence and keep proof of submission.
Request a hearing in writing if facts, authorship, intent, or document authenticity are materially disputed.
Consult the union, if any, and review the CBA and disciplinary rules.
Avoid altering files, coaching witnesses, threatening complainants, or signing an inaccurate admission.

An acknowledgment of receipt is not necessarily an admission of guilt. If asked to sign a document, read it carefully and clarify in writing whether the signature confirms receipt only.

Common mistakes

Mistakes by employers

Treating an audit variance as automatic proof of fraud;
Issuing a vague or pre-judged notice;
Giving fewer than five calendar days from actual receipt;
Withholding the information necessary to understand the charge;
Using illegally or unreliably obtained evidence;
Relying on screenshots without originals, metadata, or attribution;
Ignoring evidence that points to another person or a system failure;
Skipping a requested hearing despite substantial factual disputes;
Using preventive suspension as punishment;
Charging one offense but dismissing for a different, unanswered offense;
Invoking “loss of trust” for an employee who did not occupy a position of trust;
Applying dismissal inconsistently or disproportionately; and
Publicly identifying the employee as a fraudster before a final finding.

Mistakes by employees

Ignoring the notice or missing the response deadline;
Giving a purely emotional denial without addressing transactions and documents;
Deleting or editing potentially relevant records;
Secretly taking customer, payroll, or company data beyond what is lawfully needed;
Assuming the employer must first obtain a criminal conviction;
Signing a resignation, quitclaim, or confession without understanding it; and
Waiting too long to seek assistance after dismissal or an indefinite suspension.

Consequences of getting the process wrong

If no valid cause is proved, the dismissal may be illegal. Under Article 294 of the Labor Code, the usual statutory reliefs include reinstatement without loss of seniority and full backwages; separation pay may be awarded instead when reinstatement is no longer feasible. Other relief can depend on the claims and proven circumstances.

If valid just cause exists but the employer failed to observe statutory procedural due process, dismissal may remain valid, but the employer may be ordered to pay nominal damages. In Agabon v. NLRC, the Supreme Court fixed nominal damages at ₱30,000 for a just-cause dismissal made without the required procedure. Additional liability may arise from an unjustified suspension, unpaid benefits, bad faith, or other independently proven violations.

Termination does not remove the employer’s duty to account for earned wages and applicable final benefits. DOLE’s current guidance also addresses the timely release of final pay and certificates of employment in Labor Advisory No. 06-20.

When legal help is urgent

Seek advice from a Philippine labor lawyer, union representative, DOLE, or the NLRC promptly when:

Dismissal has already taken effect without a specific written charge;
The response period is shorter than five calendar days;
Preventive suspension will exceed 30 days without paid extension or reinstatement;
The accusation involves a large financial loss, regulated records, or possible criminal charges;
Management demands an immediate resignation, confession, or quitclaim;
Evidence may be destroyed, overwritten, or altered;
The case involves retaliation against a whistleblower or complainant;
Personal accounts or devices were searched without a clear legal or policy basis;
The decision relies on charges not contained in the notice; or
A filing deadline may be approaching.

A worker may request assistance through the Single Entry Approach, which provides conciliation before or alongside the appropriate labor process, and may file an illegal-dismissal complaint with the NLRC. Under the 2025 NLRC Rules of Procedure, illegal-dismissal claims generally prescribe in four years, while money claims generally prescribe in three years. Filing a request for assistance under Republic Act No. 10396 tolls these periods under the cited rules. Do not treat the outer prescriptive period as a reason to delay; evidence and practical remedies become harder to secure over time.

FAQ

Can an employer investigate before issuing a notice to explain?

Yes. A preliminary fact-finding inquiry may be necessary to identify the transaction, preserve evidence, and formulate a specific charge. The employer should not, however, reach an irreversible decision before hearing the employee’s side.

Is five calendar days always enough?

Five calendar days from receipt is the minimum construction under DOLE Department Order No. 147-15. More time may be necessary when the evidence is extensive, documents are unavailable, or other circumstances prevent a meaningful defense.

Must the employer give the employee every confidential document?

Not necessarily. Confidentiality, third-party privacy, privilege, trade secrets, and investigation integrity may justify appropriate limits or redactions. But the employee must still receive enough specific information to understand and answer the evidence relied upon. A decision based on undisclosed material may be difficult to defend as fair.

Is a face-to-face hearing always required?

No. A meaningful written opportunity may satisfy the rule in an uncomplicated case. A hearing or conference becomes mandatory when requested by the employee in writing, when substantial evidentiary disputes exist, when company rules or practice require one, or when comparable circumstances justify it.

Can the employer dismiss an employee who refuses to explain?

The employer may decide on properly supported evidence after valid notice and a genuine opportunity to respond. Refusal or silence does not relieve the employer of its burden to prove just cause and does not by itself establish fraud.

Can the employer file a criminal complaint at the same time?

Potentially, yes. An employment investigation and a criminal complaint are distinct proceedings. A criminal referral should be based on evidence and advice concerning the elements, jurisdiction, and preservation of admissible proof. It should not be used simply to pressure an employee into resigning or waiving labor claims.

Does repayment prevent dismissal?

Not automatically. Repayment may be relevant to mitigation, restitution, or credibility, but it does not necessarily erase a proven intentional dishonest act. Whether dismissal remains proportionate depends on the offense, position, evidence, company rules, prior record, and surrounding circumstances.

Does acquittal or dismissal of a criminal case require reinstatement?

Not automatically. Criminal and labor proceedings apply different standards. The employer must still prove the employment ground by substantial evidence and comply with procedural due process; a criminal outcome may be relevant but is not conclusive by itself.

Official sources

This article provides general legal information, not advice for a particular investigation or case. Outcomes depend on the evidence, position involved, applicable policies or CBA, notices served, and other facts. Official sources were checked for currency on August 30, 2026.