Quick answer

A private employer may investigate suspected employee fraud or falsified records, preserve relevant evidence, restrict access when reasonably necessary, and impose discipline—including dismissal—only if both requirements are met:

There is a lawful and factually supported ground for discipline. Fraud, willful breach of trust, serious misconduct, or an analogous cause may qualify under Article 297 of the Labor Code, depending on the employee’s duties and the proven act.
The employee receives procedural due process before dismissal. This normally means a detailed written charge, at least five calendar days from receipt to explain, a meaningful opportunity to answer and present evidence, an appropriate hearing when required, and a written notice of the employer’s reasoned decision.

A suspicion, audit discrepancy, anonymous accusation, unsigned statement, or general claim of “loss of trust” is not by itself enough. The employer bears the burden of proving a lawful dismissal by substantial evidence. The investigation must remain open to an innocent explanation, mistaken entry, system error, unauthorized use of credentials, or another person’s responsibility.

These rules principally address private-sector employment. Government personnel are governed by civil-service and agency disciplinary rules, while a collective bargaining agreement, employment contract, or company policy may provide additional protections.

What conduct may justify dismissal?

Article 297 of the Labor Code allows dismissal for, among other grounds:

Serious misconduct connected with the employee’s work;
Fraud or willful breach of the trust placed in the employee;
Commission of a crime or offense against the employer, an immediate family member, or an authorized representative; and
Causes analogous to those expressly listed.

Falsifying a time record, reimbursement, sales report, inventory document, medical certificate, customer acknowledgment, official receipt, payroll entry, accounting record, or approval may fall within one or more of these grounds. But the label placed on the offense is not conclusive. The employer must prove what the employee actually did, whether it was intentional, how it related to the employee’s work, and why the proven conduct meets the legal ground invoked.

Fraud or willful breach of trust

For loss of trust and confidence to support dismissal:

The employee must occupy a position of trust, such as a managerial position or a fiduciary rank-and-file position that regularly handles significant money, property, records, approvals, or similarly sensitive responsibilities;
There must be a real act connected with the employee’s duties that justifies the loss of trust;
The breach must be willful—done intentionally, knowingly, and purposely, without a justifiable excuse; and
The loss of trust must be genuine, not simulated, arbitrary, or raised as an afterthought to justify a decision already made.

The Supreme Court has emphasized that the act must rest on clearly established facts and that loss of confidence cannot be used as a pretext for an improper dismissal. See G.R. No. 188267, December 2, 2013 and G.R. No. 238147, September 29, 2021.

An inadvertent encoding error, negligent review, or failure to follow a process is not automatically fraud. Negligence and intentional falsification are different charges and have different elements.

Serious misconduct

Misconduct generally must be serious, work-related, and performed with wrongful intent—not merely a minor error or ordinary lapse. Deliberately fabricating or altering a material company record can constitute serious dishonesty or misconduct, but the surrounding facts still matter: the employee’s role, the nature and purpose of the alteration, its materiality, the applicable rules, and whether intent is supported by evidence.

A company code may classify falsification as a dismissible offense, but the rule must be lawful, known or properly communicated, applied fairly, and supported by evidence in the particular case. A handbook cannot replace the statutory requirement of just cause.

The required standard of proof

The employer does not have to prove a workplace offense beyond reasonable doubt. In a labor case, the required level is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

Even though this is a lower standard than criminal proof, it still requires evidence. Mere allegations, speculation, assumptions based only on job title, or a conclusion that the employee “must have known” are insufficient. The Supreme Court discusses this standard in G.R. No. 197402, June 30, 2021.

Once the fact of dismissal is established, the employer must prove that the dismissal was lawful. The employer should therefore be able to show both the underlying records and a reliable explanation of how those records connect the employee to the alleged act.

A fair investigation process

1. Secure the evidence without prejudging the employee

As soon as a credible issue arises, the employer should preserve relevant material in its existing form. Depending on the allegation, this may include:

Original and revised versions of documents;
Audit trails, system logs, timestamps, access records, and approval histories;
Emails, workplace messages, and instructions;
CCTV footage, subject to lawful collection and retention;
Specimen signatures or authenticated source documents;
Accounting, payroll, inventory, attendance, or point-of-sale records;
Written policies and proof that the employee received them;
Job descriptions and evidence of the employee’s actual responsibilities;
Witness accounts based on personal knowledge; and
Records showing who else had access to the document, device, account, password, or physical location.

Preserve metadata and originals whenever possible. Work from copies, record who collected each item, and document transfers or changes in custody. Avoid editing source files or asking a witness to “improve” a statement.

The investigator should also seek potentially exculpatory evidence. For example, determine whether multiple people used the account, whether credentials were compromised, whether the software automatically changed entries, or whether a supervisor instructed the employee to follow an unusual process.

2. Limit access and protect confidentiality

Information should be shared only with people who need it for the investigation, decision, legal advice, or required reporting. Investigators should avoid announcing that an employee committed fraud before a fair finding has been made.

Collection and use of personal data must comply with the Data Privacy Act of 2012. Processing should have a lawful basis and follow transparency, legitimate-purpose, proportionality, security, and retention requirements. An investigation does not create unlimited authority to search private accounts, personal devices, or unrelated communications.

Where evidence is held by a third party or in a personal account, obtain legal advice before attempting access. Do not impersonate the employee, bypass security controls, or pressure anyone to surrender material unlawfully.

3. Decide whether preventive suspension is justified

Preventive suspension is a protective measure, not a penalty. It may be used when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers. In a records case, relevant concerns may include a substantiated risk that the employee could alter or destroy vital documents, interfere with systems, or obstruct the investigation.

Suspension should not be automatic merely because the accusation is serious. Consider less restrictive measures, such as temporarily changing access rights, preserving an account, assigning non-sensitive duties, requiring dual approval, or placing the employee in another substantially equivalent work arrangement.

A preventive suspension generally may not exceed 30 days. After that, the employee must be reinstated to the former or a substantially equivalent position, or an extension must be with wages and benefits. If preventive suspension lacked sufficient basis, wages for the suspension period may become due. The governing principles are discussed in G.R. No. 207838, January 25, 2017 and G.R. No. 241360, July 6, 2021.

A written suspension notice should state its protective purpose, factual basis, starting date, expected duration, restrictions, pay status, and contact arrangements. It should not describe guilt as already established.

4. Issue a detailed first notice

If the evidence warrants a formal charge that may result in dismissal, serve a written notice to explain. It should contain enough detail for an intelligent defense, including:

The specific act or omission charged;
The records, transactions, dates, amounts, locations, or persons involved;
The employee’s alleged participation;
The relevant Labor Code ground and company rule;
Why the conduct may warrant dismissal;
A fair description of the material evidence, with access to relevant documents when reasonably possible;
The deadline and method for submitting an explanation;
The right to provide documents, identify witnesses, and request an appropriate conference; and
Contact information for reasonable questions about the process.

A vague notice such as “explain the audit discrepancies” or “explain why you should not be dismissed for loss of trust” may be inadequate.

The employee must receive a reasonable opportunity to respond. Supreme Court decisions construe this as at least five calendar days from receipt of the notice, allowing time to examine the accusation, consult a union officer or lawyer, gather evidence, and prepare a defense. See G.R. No. 247428, February 17, 2021.

Keep proof of service and receipt. If personal service is refused or impracticable, document the attempts and use a reliable method permitted by applicable rules, company policy, or the parties’ established arrangements. A notice of termination, when necessary, may be served at the employee’s last known address.

5. Give a meaningful opportunity to be heard

The employee should answer each charge, explain the circumstances, submit records, identify witnesses, challenge the authenticity or interpretation of evidence, and raise procedural objections.

A formal trial-type hearing is not required in every case. However, a conference or hearing becomes necessary when:

The employee requests one in writing;
There are substantial factual or evidentiary disputes;
A company rule, established practice, contract, or collective bargaining agreement requires one; or
Comparable circumstances make a conference necessary for a fair resolution.

This rule is explained in Perez v. Philippine Telegraph and Telephone Company, G.R. No. 152048, April 7, 2009.

At the conference, identify the participants and charges, permit a meaningful response, and prepare accurate minutes. The employee should be allowed reasonable assistance from a union representative or counsel where applicable, although the internal proceeding need not follow courtroom rules.

Silence, failure to attend, or refusal to submit an explanation does not automatically prove fraud. If the employee received a genuine opportunity but did not use it, the employer may decide the case on the available evidence, while carefully documenting service, deadlines, reminders, and any stated reason for nonparticipation.

6. Investigate the defense instead of merely receiving it

The investigator should test both the accusation and the response. Appropriate follow-up may include:

Verifying who created, accessed, edited, approved, printed, or transmitted the record;
Comparing timestamps with attendance, location, device, and system data;
Examining whether shared credentials or delegated access were allowed;
Authenticating signatures and source documents;
Reconciling accounting or inventory entries with underlying transactions;
Separately interviewing witnesses and recording the basis of their knowledge;
Checking whether the employee followed a supervisor’s instruction;
Determining whether the same rule was consistently enforced; and
Asking whether another plausible explanation remains.

Avoid asking the accused employee to prove innocence. The employer retains the burden of establishing the charge.

7. Make an impartial and proportionate decision

The decision-maker should assess each charge separately and determine:

What facts are established by substantial evidence;
Which evidence is reliable and why;
Whether intent was proven rather than presumed;
Whether the conduct satisfies the cited legal and company-rule elements;
Whether the employee occupied a position to which breach-of-trust doctrine applies;
Whether relevant defenses were investigated;
Whether similarly situated employees were treated consistently; and
Whether dismissal is proportionate under the law, policy, and circumstances.

Length of service, prior record, materiality, actual or potential harm, concealment, restitution, cooperation, and consistency of discipline may be relevant. They do not automatically excuse deliberate fraud, nor may aggravating facts be assumed without evidence.

The person who made the accusation should not be the sole decision-maker when a reasonably independent review is available. The outcome must remain undecided until the explanation and supporting evidence have been considered.

8. Issue a written decision notice

If dismissal is imposed, the second written notice should:

Identify the charges found proven and those not proven;
State the material facts and evidence relied upon;
Address the employee’s significant defenses;
Identify the legal ground and applicable company rule;
Explain why the proven conduct warrants dismissal; and
State the effective date and lawful arrangements for final pay, property return, and records.

The decision should not rely on a new accusation that was absent from the first notice. If a materially different charge emerges, give a new or supplemental notice and another reasonable opportunity to respond before relying on it.

If the charge is not sufficiently proven, close the case or impose only a lawful, proportionate sanction supported by the findings. Correct access restrictions, records, or withheld compensation as appropriate.

What employees should do after receiving a notice

Do not ignore the notice or resign impulsively. Read the charge closely and note the exact date and manner of receipt.

A useful written response should:

Answer every allegation separately;
Admit only facts that are accurate and explain their context;
Deny unsupported assertions specifically;
Identify who had access to the account, record, device, funds, or workplace;
Explain workflows, supervisor instructions, system behavior, and unusual events;
Attach authentic supporting records;
Identify witnesses and what they personally know;
Request copies or inspection of material evidence needed for a meaningful defense;
Ask for a reasonable extension before the deadline if necessary; and
Request a conference in writing when facts, authenticity, or credibility are genuinely disputed.

Keep the notice, envelope or transmission record, response, attachments, meeting invitations, minutes, suspension notice, decision, payslips, employment contract, handbook, collective bargaining agreement, and proof of submission. Preserve relevant electronic material without deleting, altering, secretly accessing restricted systems, or taking unrelated confidential company or customer information.

If asked to sign a document, check whether the signature means only “received” or signifies agreement, admission, release, or resignation. Request a copy immediately. Note the date and, if accurate, write that acknowledgment of receipt does not mean agreement.

Criminal complaints and internal discipline are different

An internal employment investigation does not determine criminal guilt. A criminal complaint for estafa, falsification, cybercrime, or another offense follows separate substantive and procedural laws, and conviction requires proof beyond reasonable doubt.

Conversely, an employer does not necessarily have to wait for a criminal conviction before completing a workplace case. Labor liability may be evaluated under the substantial-evidence standard, while prosecutors and courts independently decide criminal liability under the higher criminal standard.

Employers should not describe an employee publicly as a criminal merely because an internal charge or criminal complaint exists. Employees facing possible criminal exposure should obtain independent legal advice before giving a detailed statement, signing an admission, turning over personal devices, or agreeing to repayment terms.

Common mistakes

Mistakes by employers

Dismissing first and issuing notices afterward;
Using a generic notice without dates, transactions, documents, or specific acts;
Allowing fewer than five calendar days from receipt for the explanation;
Treating an audit variance as automatic proof of fraud;
Assuming that possession of a password proves the identity of the user;
Ignoring shared access, delegated work, system errors, or exculpatory records;
Relying only on hearsay, unsigned summaries, or conclusions without source documents;
Adding new grounds only in the dismissal letter;
Treating preventive suspension as punishment or exceeding 30 days without lawful pay arrangements;
Denying a requested hearing despite substantial factual disputes;
Applying rules inconsistently or selectively;
Circulating accusations beyond those who need to know; and
Pressuring the employee to resign, sign a waiver, or make an immediate admission.

Mistakes by employees

Ignoring the notice or missing the response deadline;
Giving a bare denial without explaining records or workflow;
Altering, deleting, forwarding, or taking evidence unlawfully;
Contacting witnesses in a way that could appear coercive;
Signing an admission, resignation, release, or repayment agreement without understanding it;
Secretly accessing systems after authority has been withdrawn;
Failing to request disputed evidence or a hearing in writing; and
Assuming that the absence or dismissal of a criminal case automatically defeats the employment charge.

Consequences of defective procedure

A dismissal may fail in two distinct ways:

No just cause: If the employer cannot prove a lawful ground by substantial evidence, the dismissal may be illegal, with remedies that can include reinstatement without loss of seniority and full back wages, subject to the facts and final adjudication.
Just cause exists, but procedure was defective: The dismissal may remain valid, but the employer can be ordered to pay nominal damages for violating statutory due process. The Supreme Court has commonly fixed nominal damages at ₱30,000 for a just-cause dismissal implemented without proper procedural due process. See Agabon v. NLRC, G.R. No. 158693, November 17, 2004 and King of Kings Transport, Inc. v. Mamac, G.R. No. 166208, June 29, 2007.

The precise relief depends on the pleaded claims, evidence, applicable law, and final findings of the labor tribunal or court.

When legal help is urgent

Seek advice promptly if:

A notice gives less than five calendar days to respond;
Preventive suspension is approaching or has exceeded 30 days;
The employer demands access to a personal account or device;
Documents appear altered, incomplete, or falsely attributed;
The matter involves large sums, regulated records, personal data, or multiple employees;
Police, the National Bureau of Investigation, prosecutors, or another regulator has contacted either party;
The employee is being asked to sign an admission, resignation, release, quitclaim, or repayment agreement;
A union or collective bargaining agreement applies;
The accusation may affect a professional license or government eligibility;
Retaliation, discrimination, or whistleblower issues may be involved; or
A dismissal notice has already been issued.

An aggrieved worker may seek assistance through the Department of Labor and Employment’s Single Entry Approach Request for Assistance system and, when appropriate, file a case before the National Labor Relations Commission. An illegal-dismissal action generally prescribes in four years from accrual, but related money claims can have different prescriptive periods. Delaying may also cause loss of evidence. The NLRC’s official FAQ and 2025 NLRC Rules of Procedure provide current procedural information.

Practical investigation checklist

Before deciding a private-sector fraud or falsification case, confirm that:

The original evidence and metadata were preserved;
Other persons with access were identified;
The investigator checked both inculpatory and exculpatory evidence;
Personal data was collected and shared only for a lawful, proportionate purpose;
Any preventive suspension had a documented serious and imminent threat basis;
The suspension did not exceed 30 days without reinstatement or paid extension;
The first notice stated detailed facts, legal grounds, and applicable rules;
The employee received at least five calendar days from receipt to explain;
Relevant evidence was made reasonably available for an intelligent defense;
A hearing was held when requested in writing or otherwise required;
Significant defenses and factual disputes were actually investigated;
Each finding was supported by substantial evidence;
Intent was proven where the charge required willfulness;
The penalty was lawful, consistent, and proportionate; and
The second notice clearly explained the findings and effective action.

FAQ

Can an employee be dismissed for one falsified document?

Possibly. A single deliberate falsification may be serious enough, particularly when it is material, work-related, and committed by an employee entrusted with money, property, approvals, or sensitive records. But there is no automatic rule: intent, authenticity, materiality, duties, policy, circumstances, evidence, and procedural fairness must all be examined.

Is actual financial loss required?

Not always. Deliberate fraud or a willful breach of trust may be serious even if the employer prevents the loss or later recovers the amount. However, the employer must still prove the act and the applicable legal ground; possible harm cannot be based on speculation.

Is an employee entitled to see every investigation document?

Not necessarily every document in unrestricted form. Confidentiality, privilege, data privacy, witness safety, and third-party rights may justify limits. But the notice and disclosure must still be sufficient for the employee to understand the material accusation and make a meaningful defense. Redaction, summaries, or supervised inspection may sometimes balance these interests.

Must the employer conduct a face-to-face hearing?

Not in every case. A meaningful written opportunity may suffice. A hearing or conference becomes necessary when the employee requests one in writing, substantial evidentiary disputes exist, company rules or established practice require it, or comparable circumstances justify it.

May an employee bring a lawyer or union representative?

An employee may consult a lawyer or union official while preparing a response. Representation during an internal conference depends on applicable law, the collective bargaining agreement, company rules, and the circumstances. A written request should be made in advance.

Is preventive suspension automatically unpaid?

The initial preventive-suspension rules focus on its protective basis and 30-day limit. Pay consequences can depend on whether the suspension was validly imposed, the applicable policy or agreement, and whether it extends beyond 30 days. An extension beyond 30 days must be with wages and benefits; an unjustified preventive suspension may result in an award of wages.

Can the employer rely on CCTV, email, or system logs?

Potentially, if the evidence was lawfully obtained, relevant, reliable, properly preserved, and fairly connected to the employee. The employer should authenticate the material, preserve context and metadata, and comply with privacy and security obligations.

Does repayment or restitution prevent dismissal?

Not automatically. Repayment may be considered, but it does not necessarily erase an intentional act or restore trust. It also does not establish guilt by itself; the circumstances and wording of any repayment agreement matter.

Does acquittal in a criminal case require reinstatement?

Not automatically. Criminal and labor proceedings use different standards and may consider different issues or evidence. The legality of dismissal must still be decided under labor law and the substantial-evidence standard.

May an employer deduct an alleged loss from final pay?

An employer should not assume an unrestricted right to deduct. Wage deductions are regulated and may require a clear legal basis, compliance with applicable rules, or valid authorization. Contested liability should be handled with particular care and legal advice.

Official sources

This article provides general legal information, not legal advice or a prediction of any case. Outcomes depend on the employee’s position, the documents, company and union rules, evidence, and procedural history. Official sources and procedures were checked as of August 26, 2026.