Evidence Handling and Counter-Affidavit Strategy (Philippine Context)

Note on scope

This is a general legal article written for Philippine procedure and doctrine. It focuses on how preliminary investigation actually works in practice, what prosecutors look for in probable cause, and how a respondent can strategically answer a subpoena through evidence and a counter-affidavit—especially in workplace, household-helper, and “entrusted access” situations where qualified theft is commonly alleged.

1) What a prosecutor subpoena means—and what it is not

A subpoena issued by a City/Provincial Prosecutor (or an assistant prosecutor) usually comes with copies of a complaint-affidavit and attachments. It typically requires the respondent to submit:

a counter-affidavit (sworn statement answering the accusations), and
supporting evidence (documents, photos, screenshots, CCTV stills, receipts, logs, affidavits of witnesses, etc.)

within a deadline commonly stated in the subpoena (often around 10 days in regular preliminary investigation practice).

What’s at stake at this stage

This is not yet a trial. The prosecutor is deciding probable cause: whether there is enough to believe (1) a crime was committed and (2) the respondent is probably guilty, warranting the filing of an Information in court.

Probable cause is a lower threshold than “proof beyond reasonable doubt.” That is exactly why the counter-affidavit must be treated as a front-loaded defense document: it is your best chance to stop the case before it becomes a court case with warrants, bail issues, and years of litigation.

What happens if you ignore it

If you do not submit a counter-affidavit and evidence, the prosecutor may treat the right to submit one as waived and resolve the case based on the complainant’s evidence alone. In practice, non-response often increases the risk of an adverse finding.

2) Qualified theft in Philippine law: the essentials

Statutory anchor

Qualified theft is theft punished more severely because of specific qualifying circumstances under the Revised Penal Code (RPC), primarily Article 310 in relation to Article 308 (definition of theft) and Article 309 (penalties, as amended in amounts by R.A. 10951).

Core elements of theft (Article 308)

To support theft, the complaint must generally show:

Taking of personal property
Personal property belongs to another
Taking is without consent of the owner
Intent to gain (animus lucrandi)
Taking is without violence or intimidation (otherwise robbery) and without force upon things (otherwise robbery by force upon things)

A respondent’s counter-affidavit strategy should usually aim to break at least one of these elements in a credible, evidence-backed way.

What makes it “qualified” (Article 310)

Qualified theft is theft committed with certain qualifiers—commonly:

by a domestic servant, or
with grave abuse of confidence, or
involving certain property/situations that the law treats as especially serious (e.g., specified classes of property or calamity-related taking)

In most modern complaints, especially employment disputes, the qualifier alleged is grave abuse of confidence—the theory being: “We trusted you because of your position, and you used that trust to take property.”

Why the qualifier matters

Article 310 increases punishment two degrees higher than simple theft. Penalty exposure can become very serious, and that severity often influences prosecutorial posture, bail exposure later, and the complainant’s leverage.

3) Preliminary investigation mechanics: how prosecutors actually decide

The record is mostly paper (and sworn statements)

Preliminary investigation is affidavit-driven:

complainant files a complaint-affidavit with supporting evidence
respondent files a counter-affidavit with supporting evidence
complainant may file a reply
respondent may file a rejoinder
prosecutor may call clarificatory hearing (not a full trial; usually limited Q&A)

There is typically no full cross-examination at this stage. That makes documentary and digital evidence—properly explained—especially important.

The prosecutor is looking for coherence and plausibility

Prosecutors commonly weigh:

whether the complainant’s version is internally consistent
whether the evidence directly connects the respondent to the taking
whether the defense explanation is credible, documented, and timely raised
whether the case looks like a criminal act or a civil/labor dispute disguised as criminal

Because this is probable cause (not trial), prosecutors can be influenced heavily by common-sense narratives supported by objective records.

4) First response checklist upon receiving the subpoena

A) Validate and calendar

Note the exact receipt date and deadline.
Keep the envelope, registry return card, or proof of service if relevant.
Create a working timeline immediately.

B) Identify what exactly is being alleged

Read the complaint for:

the exact charge (qualified theft vs theft vs estafa)
the qualifying circumstance alleged (domestic servant? grave abuse of confidence?)
the property (cash? inventory? equipment? funds?)
the time window and location
the evidence list (audit report, CCTV, witness statements, demand letters, screenshots)

C) Secure evidence without contaminating it

Preserve phone chats, emails, logs, and files in read-only copies if possible.
Avoid editing originals; preserve metadata where practicable.
For CCTV: request/export copies in the format produced by the system and document how obtained.

D) Avoid “informal admissions”

Workplace investigations, HR hearings, or “conference meetings” often produce statements later attached to criminal complaints. Be careful with:

signing prepared statements
apologizing in writing
“settlement” language that can be framed as implied admission

5) Evidence in qualified theft: what complainants submit—and how to attack it

Common prosecution-side evidence

Audit reports / inventory shortage reports
CCTV footage or still images
Access logs (keycards, POS logs, user logins)
Affidavits of co-workers, security, supervisors
Confessions (often from internal investigations)
Receipts/issuance records and custody forms
Demand letters and non-return allegations

Defense evidence themes

A strong counter-affidavit usually pairs a legal theory with concrete proof. Common defense evidence includes:

Authority / consent evidence: job description, written instructions, approvals, messages authorizing withdrawal/issuance
Alternative access: proof others had keys, shared logins, weak controls, multiple custodians
Impossibility / mismatch: schedules, biometrics, timecards, location data, delivery logs
Reconciliation: corrected inventory counts, return forms, later-discovered items, accounting reversals
Credibility impeachment: inconsistent dates, shifting amounts, altered records, biased witnesses
Digital authenticity: complete chat threads, original emails with headers, system reports with provenance

Attacking “shortage-only” cases

A recurring pattern: “There’s a shortage; therefore, the cashier/warehouseman stole it.”

Weak points to highlight:

shortage is not automatically taking by a specific person
failure to prove exclusive access
lack of direct link (no CCTV, no traced proceeds, no recovery, no witness of taking)
poor internal controls (shared credentials, no dual custody, no daily reconciliation)

Shortage evidence can support suspicion but may fail to establish probable cause against a particular respondent if the chain of inference is too speculative.

Attacking CCTV evidence

CCTV can be persuasive, but common vulnerabilities:

unclear identity (angle/quality/obstruction)
gaps in footage/time stamps
no continuity showing the item was taken out and not returned
weak authentication (who retrieved it, how stored, any tampering controls)

At preliminary investigation, you don’t need to prove tampering beyond doubt; you need to show reasonable doubt about reliability and identification.

Attacking alleged “confessions” from private investigations

A frequent flashpoint is a written “admission” obtained during HR/security questioning.

Key issues to develop:

context (threats of termination, detention, coercive conditions)
lack of counsel during custodial-type questioning (especially if police were involved)
whether the statement is actually an admission of theft or merely an explanation of discrepancy
whether it was voluntary, complete, and accurately recorded

Even without a full trial-level suppression hearing, raising concrete facts undermining voluntariness and accuracy can reduce the statement’s weight for probable cause.

6) The biggest doctrinal fault line: qualified theft vs estafa (possession theory)

Many complaints are miscast. One of the most important strategic angles is whether the facts describe theft at all.

Theft typically involves “taking” where the offender has only material access

In many employment settings, an employee may have physical access to property but not the legal right to possess it as owner/custodian. Misappropriation can be charged as theft.

Estafa generally involves misappropriation where the offender had juridical possession

If the respondent received property with juridical possession (possession recognized by law, with a duty to return or deliver), and then misappropriated it, the proper charge is often estafa, not theft.

This distinction is highly fact-specific. Where it helps strategically:

if the complaint’s own narrative indicates entrustment with juridical possession, the respondent can argue wrong offense charged, undermining probable cause for qualified theft
it can reframe the case as a civil/contractual dispute or a different criminal theory requiring different elements the complainant has not supported

Even if reclassification is possible, prosecutors sometimes dismiss when the chosen charge is legally mismatched and the evidence is thin.

7) Counter-affidavit architecture: how to write it to win at probable cause

A counter-affidavit is not a “denial letter.” It is a sworn evidentiary document designed to persuade a prosecutor that probable cause is lacking.

A) Non-negotiables

It must be sworn and properly notarized.
It should answer the complaint point-by-point, but without adopting the complainant’s framing.
All defenses that depend on facts should be supported by attachments (“Annexes”).
Avoid speculation; state what is known, what is not, and why the complainant’s inference fails.

B) Recommended structure

Introductory facts
- identity, position, relationship to complainant, nature of duties
Narrative timeline (dates and events)
- anchor everything to records: timecards, logs, messages, receipts
Direct responses to key allegations
Affirmative defense theory (choose one primary and one secondary)
Evidence discussion (explain annexes clearly)
Legal element-by-element analysis
- show which element(s) fail and why evidence is insufficient for probable cause
Relief
- dismissal for lack of probable cause (or dismissal/recommendation for appropriate action)

C) The element-by-element method (highly effective)

Use headings like:

No taking by respondent
No intent to gain (or presence of good faith / claim of right)
Consent/authority existed
Identity not established
Grave abuse of confidence not shown (qualifier fails)
Evidence is speculative / lacks chain of linkage

Prosecutors are trained to think in elements; feed the analysis in that format.

D) Annex discipline

A prosecutor confronted with 80 pages of attachments without a guide may ignore them.

Best practice:

label annexes cleanly: Annex “A” – Work Schedule, Annex “B” – POS Log, etc.
cite them in-text precisely: “As shown in Annex ‘C,’…”
include a short Annex Index
attach only what matters; quality beats volume

E) Tone and risk management

Avoid personal attacks; focus on factual contradictions and evidentiary gaps.
Do not exaggerate. Overstatement can backfire when compared to complainant annexes.
Do not include statements that could create a new criminal exposure (e.g., admissions that fit another charge) unless strategically unavoidable and tightly explained.

8) Defense strategies tailored to common qualified theft fact patterns

Pattern 1: Workplace inventory/cash shortage attributed to one employee

Core strategy: break exclusive access + show control weaknesses + show speculative inference.

Evidence ideas:

proof of shared keys/shared logins
log discrepancies, void/refund authority of others
lack of contemporaneous reconciliation
CCTV gaps or non-identification
audit methodology flaws (counting, sampling, timing)

Element attack:

taking and identity not shown; shortage ≠ theft
qualifier (grave abuse) may fail if duties did not involve trust-based custody or if many had equal access

Pattern 2: Alleged “pocketing” captured on CCTV

Core strategy: identity + continuity + object proof.

Evidence ideas:

clearer alternative camera angles (if available)
time and location proof showing respondent elsewhere
continuity challenge: footage does not show the object leaving premises or not being returned
object ambiguity: what is seen is not identified as the missing item

Element attack:

taking not established beyond ambiguous gesture; intent to gain speculative

Pattern 3: Company funds allegedly diverted (withdrawals, transfers)

Core strategy: authority/approval trail + process proof + benefit tracing.

Evidence ideas:

approvals, emails, chat instructions
bank documents showing authorized signatories
proof respondent did not receive proceeds
company SOP showing division of roles (who approves vs who processes)

Element attack:

absence of intent to gain; absence of unlawful taking if authorized
if respondent had juridical possession/entrustment, argue miscast offense (estafa theory), undermining qualified theft probable cause

Pattern 4: Domestic helper alleged to have taken valuables

Core strategy: opportunity ≠ identity; emphasize access by others + reporting delays + inconsistent item descriptions.

Evidence ideas:

household access logs (guards, visitors, repairmen)
inconsistencies in item descriptions/ownership proof
timeline gaps between last seen and discovery
proof of return of items or continued presence

Element attack:

identity not established; animus lucrandi presumed only when taking shown, not from mere access

Pattern 5: “Non-return” of property after resignation/termination

Core strategy: show dispute is about custody/turnover; demonstrate attempted return; demonstrate unclear demand.

Evidence ideas:

turnover emails/messages
inventory/acknowledgment forms
proof property remained at workplace or was available for pickup
proof of ongoing settlement discussions

Element attack:

absence of taking; absence of intent to gain; case may be civil/administrative

9) Attacking the qualifier: “grave abuse of confidence” (the usual battleground)

To sustain the qualifier, the complaint must do more than say “we trusted him/her.”

Strong counter points:

the position did not involve the level of trust/confidence claimed
access was routine and not trust-based; many employees had the same access
the alleged act did not depend on the special confidence reposed
internal control structure shows the respondent was not the accountable custodian

Where the qualifier fails, the case may be reduced to simple theft (still serious) or dismissed if the evidence is already thin and the complaint overreaches.

10) Procedural tactics around the subpoena

A) Extension requests

If time is insufficient to gather records, an extension to file counter-affidavit is commonly requested. The best extension motions:

are filed before the deadline
explain the reason (volume of records, need to obtain CCTV exports, need to secure affidavits)
request a specific period (not open-ended)

B) Request for complete copies / better particulars

If attachments are missing or illegible, request readable copies. A defense can also point out vagueness:

unspecified dates
shifting amounts
unidentified property
generic allegations without particulars

Vagueness can undercut probable cause because a respondent cannot meaningfully answer what is not concretely alleged.

C) Clarificatory hearing posture

If a hearing is set:

treat it as a controlled proceeding; it can lock in positions
answers should be consistent with the counter-affidavit
do not volunteer admissions; stay within your narrative and annex references

11) What happens after you file

Possible outcomes

Dismissal (no probable cause)
Filing of Information in court (probable cause found)
Sometimes, recommendation for a different charge (less common, fact-dependent)

If dismissed

Complainants may seek reconsideration or DOJ review depending on applicable rules and timing.

If Information is filed

Court processes begin (raffle, summons/warrant evaluation, bail setting depending on penalty). At that point, litigation strategy shifts to trial defenses, motions, and possibly bail management.

12) Practical drafting pitfalls that quietly sink counter-affidavits

Pure denials without annexes
Inconsistent dates (even minor ones)
Over-arguing without addressing key evidence (e.g., ignoring CCTV)
Submitting screenshots without context (no full thread; no identifiers)
Admitting control/possession unnecessarily
Failing to address the qualifier (grave abuse / domestic servant status)
Disorganized annexes that a prosecutor cannot quickly verify

13) A compact evidence-and-counter-affidavit checklist (usable as a workflow)

Evidence collection

Employment/relationship documents (contract, job description, SOPs)
Access control proof (keys, key logs, login access, shared accounts)
Time/location proof (DTR, biometrics, schedules, receipts)
Communications (full chat/email threads with timestamps)
Transaction records (POS logs, bank records, approvals)
Inventory/audit materials (methodology, count sheets, reconciliations)
CCTV exports (original format + explanation of retrieval)
Witness affidavits (people who can attest to authority, access, process)

Counter-affidavit build

Clean timeline
Element-by-element attack
Qualifier-focused rebuttal
Annex index + precise references
One-page “core theory” summary embedded as headings, not as emotional rhetoric

14) The strategic heart of the response

A prosecutor subpoena in a qualified theft complaint is a contest over inference. The complainant tries to connect access + discrepancy + suspicion into probable cause. The respondent’s winning response is usually:

a documented alternative narrative that is more coherent than the accusation, and/or
a surgical demolition of one or two required elements (especially identity/taking/intent), and/or
a qualifier-focused rebuttal showing overreach and weak linkage between “trust” and the alleged taking

The counter-affidavit is not merely an answer—it is the respondent’s first and often best opportunity to prevent a property dispute, workplace fallout, or suspicion-driven complaint from becoming a full criminal case in court.