Quick answer

An employer may investigate suspected employee fraud or falsified records, but suspicion alone does not justify dismissal. For a lawful termination in the Philippine private sector, the employer must establish a just cause by substantial evidence and observe procedural due process: a specific written charge, at least five calendar days for the employee to explain, a meaningful opportunity to be heard, an impartial evaluation of the evidence, and a written decision.

Falsification may support dismissal for fraud, serious misconduct, willful breach of trust, or a comparable violation of a valid company rule. The correct ground depends on the employee’s duties, the act committed, the evidence, and the employer’s policies. An honest mistake, unexplained discrepancy, or unverified accusation should not automatically be treated as fraud.

These rules concern employment discipline in the private sector. Government employees are generally covered by civil-service and agency disciplinary rules, while a collective bargaining agreement, employment contract, or company policy may provide additional safeguards.

What the employer must prove

Article 297 of the Labor Code permits termination for several just causes, including serious misconduct and fraud or willful breach of the trust reposed in the employee. It also recognizes causes analogous to those expressly listed. The complete statutory grounds appear in the Supreme Court’s discussion of Article 297 of the Labor Code.

The employer bears the burden of proving that a dismissal was valid. The required standard in a labor case is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion. This is lower than proof beyond reasonable doubt, but it still requires established facts rather than rumor, conjecture, or a decision made in advance.

Fraud or dishonesty

Fraud generally involves a deliberate act intended to deceive, defraud, or betray the employer. Inadvertent encoding, a good-faith misunderstanding, or ordinary negligence is not automatically fraud.

Evidence should address questions such as:

What information or record was false?
Who prepared, altered, approved, or submitted it?
Was the employee aware that it was false?
Was the act intentional?
What purpose or benefit did it serve?
Did the employee have authority over the record or transaction?
Is there a credible innocent explanation?
Did the conduct affect the employer, its clients, employees, property, or operations?

Willful breach of trust

Loss of trust and confidence is not a catch-all ground. The Supreme Court requires:

The employee must occupy a position of trust and confidence; and
There must be a work-related act that justifies the loss of trust.

Positions of trust generally include managerial employees and fiduciary rank-and-file employees who regularly handle significant money, property, records, access, or other sensitive responsibilities. Even for these employees, the breach must be willful—intentional, knowing, and without justifiable excuse—and supported by substantial evidence. The Supreme Court has cautioned that loss of trust cannot rest on speculation or the employer’s mere suspicion in Jalit v. Heung-A Shipping Corporation.

For rank-and-file employees who do not hold fiduciary positions, the employer should not simply label the case “loss of trust.” It must identify an applicable statutory ground or valid company rule and prove the employee’s actual participation.

Serious misconduct

Falsification may amount to serious misconduct when the conduct is grave, work-related, willful, and shows that the employee has become unfit to continue working for the employer. Wrongful intent matters. The Supreme Court explains these elements in Musahamat Workers Labor Union-1-ALU v. Musahamat Farms, Inc..

Violation of a company rule

A disciplinary rule should be lawful, reasonable, connected with the work, and properly communicated. The notice to explain should identify the particular rule allegedly violated and the corresponding possible penalty. An employer should also apply its rules consistently and consider whether dismissal is proportionate under the policy and the circumstances.

A fair investigation, step by step

1. Secure the records without deciding guilt

Preserve the original documents and relevant electronic data before they can be changed or lost. Depending on the allegation, this may include:

Original forms, vouchers, receipts, reports, time records, medical certificates, expense claims, or inventory records;
Document versions and audit trails;
System-access, approval, login, and transaction logs;
Relevant emails, messages, and attachments;
CCTV footage retained in the ordinary course;
Specimen signatures or authenticated comparison documents;
Written policies, job descriptions, approval limits, and workflow records; and
Statements from people with personal knowledge.

Record who obtained each item, where it came from, and how it was preserved. Keep an untouched copy of electronic evidence where practicable. Do not alter metadata, overwrite the employee’s account, or circulate allegations beyond people who need the information for the investigation.

Evidence collection must still respect applicable privacy, confidentiality, access-control, and cybersecurity rules. Access should be limited to material reasonably connected to the inquiry.

2. Verify the discrepancy and possible explanations

Before accusing anyone, determine whether the record is genuinely false or merely inconsistent. Check for system errors, duplicate entries, delegated access, unclear procedures, missing approvals, template problems, and actions by other users.

Interview witnesses separately and obtain signed, dated statements where appropriate. Distinguish firsthand knowledge from hearsay. Ask neutral questions and document both incriminating and exculpatory information.

3. Identify the exact charge

Match the known facts to the proper legal or company-policy ground. Avoid vague accusations such as “dishonesty,” “fraud,” or “loss of confidence” without identifying the transaction, date, document, entry, amount, conduct, and employee involvement.

If new and materially different allegations emerge, issue a supplemental notice and allow the employee a fair opportunity to answer them. A final decision should not rely on a charge that the employee never had a chance to address.

4. Issue a specific written notice to explain

Under DOLE Department Order No. 147-15, the first notice should:

State the specific grounds or causes being considered;
Narrate the detailed facts and circumstances supporting the charge;
Identify the company rule and Labor Code ground, when applicable;
State that dismissal is among the possible consequences if warranted; and
Direct the employee to submit a written explanation within a reasonable period.

A “reasonable period” means at least five calendar days from receipt of the notice. This period allows the employee to study the charge, consult a union representative or lawyer if desired, gather records, and prepare a defense. The official text is available in DOLE Department Order No. 147-15.

Keep reliable proof of service. If the employee refuses to receive or sign, document the attempt through witnesses and use a verifiable alternative method. A signature acknowledging receipt is not an admission of guilt.

5. Give a meaningful opportunity to be heard

The employee must be allowed to answer, submit records, identify witnesses, and challenge material inaccuracies. A formal, trial-type hearing is not required in every case; due process principally requires a real opportunity to explain.

A conference or hearing should be conducted when:

The employee requests one in writing;
Material factual disputes cannot fairly be resolved from the written submissions;
The employee needs to confront or clarify significant evidence; or
A company rule, contract, or collective bargaining agreement requires it.

The employer should provide reasonable information about the evidence being relied upon, subject to legitimate confidentiality and safety concerns, so the employee can give an informed response. A notice that merely announces an accusation without sufficient particulars is inadequate.

The requirements for the first notice, opportunity to be heard, and final notice are discussed in King of Kings Transport, Inc. v. Mamac.

6. Evaluate the entire record impartially

The decision-maker should consider:

The employee’s explanation and supporting evidence;
Whether authorship or participation was reliably established;
Whether the act was intentional;
The employee’s duties and degree of trust;
The seriousness and work connection of the act;
The actual or reasonably threatened harm;
The relevant company rule and stated penalty;
Prior offenses, if properly documented and legally relevant;
Consistency with treatment of comparable cases; and
Whether a lesser penalty is appropriate.

An admission should be voluntary, clear, and considered in context. Pressure to resign, sign a prepared confession, waive claims, or accept liability can undermine the fairness and reliability of the process.

7. Issue a reasoned written decision

If the charge is not established, close the case and communicate the result appropriately.

If discipline is imposed, the final notice should state:

The charge or charges resolved;
The material facts found;
The evidence considered;
Why the explanation was accepted or rejected;
The company rule and legal ground applied;
The penalty and its effective date; and
Any internal appeal or grievance procedure available.

For dismissal, the notice must be served only after the employee has received and had a fair chance to answer the first notice. A generic termination letter saying only that “management has lost confidence” is risky and may fail to show that the employer genuinely evaluated the defense.

Preventive suspension is limited

Preventive suspension is not an automatic response to a fraud allegation and is not itself a penalty. It may be used only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. The employer should document the specific threat, such as continuing access to funds, records, systems, evidence, or vulnerable witnesses.

Preventive suspension ordinarily cannot exceed 30 days. After that, the employer must either:

Reinstate the employee to the former or a substantially equivalent position; or
Extend the suspension while paying the employee’s wages and benefits during the extension.

If the employee is eventually dismissed, wages paid during a valid extension are not reimbursable. The governing restrictions and the risks of an indefinite suspension are explained in Lagamayo v. Cullinan Group, Inc..

Where continued access is the concern, proportionate interim measures—such as changing passwords, limiting financial authority, preserving devices, reassigning sensitive duties, or placing the employee in a safe equivalent role—may sometimes address the risk without suspension.

Employment action and a criminal case are separate

Falsifying records may also raise civil or criminal issues, depending on the document, intent, resulting damage, and other facts. An internal employment investigation, however, is separate from a criminal prosecution.

The employer generally does not need to wait for a criminal conviction before deciding an administrative case, provided the employment decision is independently supported by substantial evidence and due process was observed. Conversely, filing a police or prosecutor’s complaint does not by itself establish just cause for dismissal.

An acquittal, dismissal of a criminal complaint, or absence of criminal charges does not automatically resolve the labor case because the proceedings may involve different issues and standards of proof. Employers should avoid stating that an employee committed a crime as an established fact unless the wording is supported by the status and record of the case.

Where criminal exposure is realistic, both sides should obtain independent legal advice promptly. An employee may choose to consult counsel before making statements that could later be used outside the workplace investigation.

Rights and practical steps for an accused employee

An employee who receives a notice to explain should not ignore it, even if the charge appears false or incomplete.

Practical steps include:

Note the date and method of receipt. Confirm that the response period is at least five calendar days.
Request the particulars or reasonably necessary records if the notice is vague.
Preserve the notice, attachments, policies, relevant messages, payslips, attendance records, and proof of prior instructions or approvals.
Prepare a chronological, factual response. Address each allegation separately.
Identify system errors, shared access, delegated tasks, missing context, or other possible actors only when supported by facts.
Attach copies rather than surrendering the only originals.
Request a conference in writing if important facts are disputed or need clarification.
Consult the union, if any, and review the collective bargaining agreement or grievance procedure.
Keep proof that the response and attachments were submitted.
Continue reporting for work unless validly suspended, dismissed, or instructed otherwise in writing.

Do not alter company files, delete messages, coach witnesses, obtain records through unauthorized access, or retaliate against a complainant. If asked to sign a document, read it carefully. An acknowledgment of receipt may be qualified as receipt only; an admission, resignation, quitclaim, or settlement has different consequences.

Common mistakes that create legal risk

For employers:

Treating an audit exception as conclusive proof of fraud;
Issuing a vague notice without dates, transactions, documents, or rules;
Allowing fewer than five calendar days to explain;
Announcing guilt or termination before receiving the defense;
Relying on evidence or a charge never disclosed to the employee;
Using “loss of trust” for an employee who does not hold a position of trust;
Failing to establish intent or the employee’s actual participation;
Extending unpaid preventive suspension beyond 30 days;
Ignoring a required hearing, grievance procedure, or CBA protection;
Applying penalties inconsistently; or
Pressuring the employee to resign instead of completing due process.

For employees:

Missing the response deadline without requesting an extension;
Giving only a blanket denial;
Signing an inaccurate confession or resignation under pressure without documenting the circumstances;
Taking confidential files without authority;
Deleting potentially relevant evidence; or
Assuming that an internal appeal automatically stops external filing deadlines.

Consequences of an invalid process

Substantive and procedural due process are distinct.

If the employer fails to prove a valid cause, the dismissal may be illegal. Depending on the case, the remedies may include reinstatement without loss of seniority rights, full back wages, or separation pay when reinstatement is no longer appropriate, together with other relief supported by law and the evidence.

If a just cause is proved but the employer failed to observe statutory procedural due process, the dismissal may remain valid, but the employer may be ordered to pay nominal damages. In Agabon v. NLRC, the Supreme Court fixed nominal damages at ₱30,000 for a just-cause dismissal implemented without the required procedure. The result and amount remain dependent on the governing jurisprudence and the circumstances presented to the tribunal.

When legal help is urgent

Prompt legal advice is especially important when:

A termination notice has already been issued;
Preventive suspension is approaching or has exceeded 30 days;
The employee is being pressured to resign, confess, or sign a quitclaim;
Evidence may be deleted, overwritten, or tampered with;
The disputed record concerns a large financial loss, regulated transaction, tax matter, medical record, safety document, or government filing;
Police, prosecutors, regulators, or data-protection authorities are involved;
The employee is a union officer or the CBA contains a mandatory grievance process;
Retaliation, discrimination, whistleblowing, or harassment may be involved; or
Filing deadlines may expire.

Most labor and employment disputes must first undergo mandatory conciliation-mediation through the Single Entry Approach. An employee or employer may seek assistance through a DOLE, NCMB, or NLRC Single Entry Assistance Desk. The NLRC official website provides current contact details and access to its SEnA e-Request service.

An illegal-dismissal action generally prescribes in four years from accrual of the cause of action. Separate monetary claims may be subject to a different, commonly shorter period. Do not wait for the four-year limit when evidence, internal remedies, or other claims may have earlier deadlines. The NLRC confirms the illegal-dismissal period in its official frequently asked questions, and its current adjudicatory procedures appear in the 2025 NLRC Rules of Procedure.

Frequently asked questions

Can an employee be dismissed for one falsified record?

Possibly. There is no universal “one incident” exemption. A single deliberate falsification may be sufficiently serious, particularly when it concerns money, property, safety, regulated records, or a position requiring substantial trust. The employer must still prove the act, intent, applicable ground, and proportionality, and must observe due process.

Is a notice to explain already a finding of guilt?

No. It should state allegations and possible grounds, not a predetermined conclusion. Its purpose is to let the employee understand and answer the case before a decision is made.

Must the employer give the employee five working days?

The governing rule states at least five calendar days from receipt, not five working days. More time may be appropriate where the allegations or records are extensive.

Is an in-person hearing always required?

No. A formal trial-type hearing is not required in every disciplinary case. A genuine opportunity to submit a written explanation may suffice, but a conference should be held when requested in writing, required by policy or agreement, or necessary to resolve substantial factual disputes.

Can silence be treated as an admission?

Not automatically. If the employee fails to respond despite proper notice and a fair opportunity, the employer may decide using the available evidence. The employer must still prove the charge; the employee’s silence does not cure weak or speculative evidence.

May the employer withhold final pay to recover an alleged loss?

An accusation alone does not create an unlimited right to withhold wages or final pay. Wage deductions, setoffs, and recovery of losses are governed by separate legal requirements. The employer should identify a lawful basis and obtain case-specific advice before making deductions.

Can the employee bring a lawyer or union representative?

An employee may seek assistance and should check the CBA or company rules regarding representation during an internal conference. Whether counsel or another representative may participate in a particular meeting can depend on the governing agreement, policy, and circumstances. Criminal exposure is a strong reason to obtain independent counsel early.

Does resignation end the investigation?

Not necessarily. An employer may preserve records and pursue lawful civil, criminal, regulatory, or internal remedies. But a resignation obtained through intimidation or circumstances leaving no reasonable alternative may be challenged as involuntary or constructive dismissal.

Should the employer report suspected falsification to the police immediately?

That depends on the evidence, nature of the document, potential harm, reporting duties, and need to preserve legal rights. A criminal referral should not be used merely as leverage in an employment dispute. Obtain legal advice before making accusations to outside parties.

Official legal references

This article provides general Philippine legal information, not legal advice or a determination of any person’s liability. Outcomes depend on the evidence, employment status, applicable policies or CBA, and procedural history. Official sources were checked as of August 26, 2026.