Quick answer

A private employer may investigate suspected employee fraud or falsified records, but it should not treat suspicion as proof or dismissal as automatic. If discipline may lead to termination, Philippine labor law generally requires both:

A valid, factually supported cause, such as serious misconduct, fraud, or willful breach of trust under Article 297 of the Labor Code; and
Procedural due process, normally consisting of a detailed first written notice, at least five calendar days to explain, a meaningful opportunity to be heard, an impartial evaluation of the evidence, and a written notice of the final decision.

The employer must establish the charge with substantial evidence—not rumor, a bare accusation, or loss of confidence asserted without supporting facts. Falsification can justify dismissal when it is intentional, work-related, sufficiently serious, and supported by the evidence, but the result depends on the employee’s role, the document involved, the surrounding circumstances, company rules, and the actual harm or risk created.

These rules principally concern private-sector employment. Government personnel, seafarers, overseas Filipino workers, and employees covered by a collective bargaining agreement or special disciplinary system may be subject to additional procedures.

What conduct may justify discipline or dismissal?

Article 297 of the Labor Code recognizes several just causes that may be relevant to fraudulent conduct, including:

Serious misconduct connected with the employee’s work;
Fraud or willful breach of the trust placed in the employee;
Commission of a crime or offense against the employer, specified family members, or an authorized representative; and
Causes analogous to those expressly listed.

The applicable ground should match the proven conduct. An employer should not simply label every discrepancy “fraud.”

Fraud ordinarily involves deliberate deception. A willful breach is intentional, knowing, and purposeful—not merely careless, thoughtless, or inadvertent. Serious misconduct must be grave, work-related, and indicate that the employee has become unfit to continue working for the employer. The Supreme Court discusses these distinctions in Gomez v. Crossworld Marine Services, Inc. and JR Hauling Services v. Solamo.

Possible examples include intentionally:

Altering time, attendance, payroll, reimbursement, inventory, sales, delivery, or accounting records;
Submitting fake receipts, certificates, medical documents, approvals, or supporting papers;
Creating fictitious transactions, customers, suppliers, employees, or expenses;
Concealing shortages or unauthorized releases through false entries;
Using another person’s credentials or signature to make a record appear authorized; or
Directing or helping another person to falsify company records.

However, an inaccurate entry may result from mistake, poor training, unclear procedures, system failure, shared access, or negligence rather than fraud. The investigation must determine intent, responsibility, and context instead of assuming them.

Loss of trust is not a shortcut

An employer invoking loss of trust and confidence should establish:

That the employee occupied a position of trust; and
That a proven work-related act supplied a genuine basis for the loss of trust.

Positions of trust may include managerial employees and rank-and-file employees who regularly handle significant money, property, records, approvals, or similarly sensitive matters. Job title alone is not decisive; the employee’s actual duties matter.

The loss must rest on substantial evidence and cannot be a pretext, whim, or reaction to unsupported suspicion. A general statement that “management no longer trusts the employee” is insufficient. The Supreme Court explains these safeguards in Gomez and Singfield v. Tech Mahindra Limited.

A defensible investigation process

1. Secure relevant evidence without prejudging the case

Preserve the original records and prevent routine deletion or alteration. Depending on the allegation, relevant material may include:

Original forms, receipts, invoices, vouchers, ledgers, and logbooks;
Audit trails, file metadata, access logs, version histories, and approval records;
Emails, work messages, system-generated reports, and transaction records;
CCTV footage preserved before automatic overwriting;
Relevant policies, job descriptions, authorization matrices, and training records;
Witness statements based on personal knowledge; and
Records showing who created, accessed, reviewed, changed, or benefited from the transaction.

Document when and how each item was obtained, who handled it, and whether it is an original, export, screenshot, or copy. Preserve files in their native format when possible. A screenshot may be useful, but it can omit metadata or surrounding context.

Access to employee data, accounts, devices, or communications should remain lawful, necessary, proportionate, and consistent with declared company policies and the Data Privacy Act. Investigators should avoid collecting unrelated personal material or accessing private accounts without lawful authority.

2. Define the allegation precisely

Before issuing a notice, identify:

The particular record or transaction;
The questioned entry, signature, attachment, or representation;
When and where the act allegedly occurred;
The employee’s alleged participation;
The evidence connecting the employee to the act;
The policy or legal ground allegedly violated; and
Whether the theory is deliberate falsification, participation, concealment, serious misconduct, negligence, or another offense.

Do not combine unrelated incidents into a vague accusation. If new and materially different allegations emerge, give the employee a fair opportunity to answer them before relying on them.

3. Issue a detailed first notice

The notice to explain should state the specific acts or omissions being charged. It should contain a sufficiently detailed narration of the facts, identify the relevant company rule and potential Labor Code ground, and explain that dismissal is among the possible consequences if applicable.

The employee must ordinarily receive at least five calendar days from receipt to prepare a written explanation. This period allows the employee to study the charge, seek help from a lawyer or union representative, collect documents, and formulate a defense. The Supreme Court applies this standard in Distribution & Control Products, Inc. v. Santos, reflecting DOLE Department Order No. 147-15.

A shorter deadline creates avoidable due-process risk. Additional reasonable time may be appropriate when records are extensive, the employee is ill, documents are controlled by the employer, or another legitimate circumstance prevents a meaningful response.

Keep proof of service. If the employee refuses to acknowledge receipt, document the attempted service through witnesses and use another reliable permitted method.

4. Give a meaningful opportunity to be heard

Due process does not invariably require a trial-like hearing. A written explanation can satisfy the opportunity-to-be-heard requirement when it genuinely allows the employee to answer the charge and submit evidence.

A conference or hearing becomes particularly important—and under DOLE rules may become mandatory—when:

The employee requests one in writing;
Substantial evidentiary disputes exist;
A company rule, established practice, or collective bargaining agreement requires it; or
Comparable circumstances make a conference necessary for fairness.

The employee should be allowed reasonable assistance from a union representative or lawyer if desired. The investigator should address material defenses rather than merely collect a response after the decision has already been made. A formal hearing and cross-examination are not automatically required in every private-employment case, as explained in Domingo v. Philippine Long Distance Telephone Company.

5. Evaluate all evidence fairly

The decision-maker should consider inculpatory and exculpatory evidence, including:

Whether the employee actually controlled or had access to the record;
Whether credentials or devices were shared;
Whether the system records identify a user, device, time, and specific action;
Whether another person could have made the entry;
Whether the employee received or intended a benefit;
Whether the disputed act was authorized or followed an established practice;
Whether the policy was clear, communicated, and consistently enforced;
Whether the employee’s explanation is supported by records or witnesses; and
Whether the proposed penalty is proportionate to the proven offense.

An internal administrative case does not require proof beyond reasonable doubt, the standard used in criminal prosecutions. In labor proceedings, the employer must support the dismissal with substantial evidence, meaning relevant evidence that a reasonable mind might accept as adequate. Bare accusations and generalized recitations of offenses do not meet that standard.

6. Issue a reasoned second notice

After considering the explanation and evidence, provide a written decision stating:

Which charges were established or not established;
The material evidence and defenses considered;
The company rule and legal ground applied;
The penalty imposed and its effective date; and
Any internal review or appeal procedure required by policy or agreement.

The decision should correspond to the allegations in the first notice. An employee should not be dismissed on a materially different ground that the employee had no opportunity to answer.

The two-notice rule and opportunity to be heard are summarized in Domingo.

When preventive suspension is allowed

Preventive suspension is not supposed to be an advance punishment. It may be used only when the employee’s continued presence poses a serious and imminent threat to the life or property of the employer or co-workers—for example, a concrete risk of further loss, evidence tampering, or unauthorized access to sensitive assets.

A preventive suspension generally cannot exceed 30 days. After that, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the employee’s wages and other benefits during the extension. An unsupported, indefinite, or improperly prolonged suspension may result in wage liability or constructive dismissal. See Every Nation Language Institute v. Dela Cruz and Maula v. Ximex Delivery Express, Inc..

Less restrictive safeguards may sometimes be sufficient, such as temporarily removing system access, changing approval authority, securing records, reassigning custodial functions, or placing the employee in a substantially equivalent role. Any measure must be applied in good faith and must not amount to a demotion, punishment, or forced resignation disguised as an investigation step.

Must the employer wait for a criminal case?

Not necessarily. A workplace administrative investigation and a criminal case serve different purposes and use different procedures and standards of proof. An employer may generally complete a fair administrative process without waiting for a prosecutor or court, provided the employer has substantial evidence of a lawful ground for discipline.

Likewise, filing a police report or criminal complaint does not by itself prove that dismissal is valid. The employer must still establish the workplace charge and observe labor due process.

Potential criminal liability for falsification, fraud, theft, estafa, cybercrime, or related conduct is highly fact-specific. The document’s nature, how it was made or used, the alleged intent, and applicable special laws matter. Employers and employees should obtain legal advice before making sworn accusations, surrendering original evidence, or assuming that a workplace finding establishes criminal guilt.

Evidence an employee should preserve

An accused employee should promptly keep lawful copies of:

The notice to explain and proof of when it was received;
The written explanation and proof of submission;
Invitations, hearing notices, minutes, and the final decision;
Employment contract, job description, handbook, code of conduct, and relevant CBA provisions;
Records showing system access, approvals, assignments, schedules, or handovers;
Emails or messages that show authorization, instructions, common practices, or technical problems;
Pay slips and notices concerning preventive suspension; and
Names of witnesses with direct personal knowledge.

The explanation should answer each allegation clearly, identify supporting documents, correct factual errors, and state when relevant evidence is held by the employer. If a hearing is needed because important facts are disputed, request it in writing. Do not alter, delete, backdate, or secretly remove records, and do not access systems after authority has been withdrawn.

Common mistakes

Mistakes employers should avoid

Issuing a generic notice that says only “fraud,” “dishonesty,” or “loss of trust”;
Giving less than five calendar days without a legally defensible basis;
Deciding the outcome before receiving and assessing the explanation;
Relying solely on hearsay, anonymous accusations, or an unexplained spreadsheet;
Treating access to a system as conclusive proof that the employee made the entry;
Adding new grounds only in the termination notice;
Ignoring a requested hearing where material facts are disputed;
Imposing preventive suspension without a serious and imminent threat;
Exceeding 30 days of unpaid preventive suspension;
Disregarding the handbook, CBA, established practice, or progressive-discipline rules; or
Pressuring the employee to resign or sign an admission.

Mistakes employees should avoid

Ignoring the notice or responding only with a blanket denial;
Missing the deadline without requesting an extension;
Signing minutes, admissions, or resignation papers without reading them;
Deleting messages or modifying disputed files;
Contacting witnesses in a way that could be viewed as intimidation or evidence tampering;
Taking confidential company records unrelated to the defense; or
Assuming that the absence of a criminal complaint automatically defeats the administrative case.

Consequences of getting the process wrong

If no valid cause is proven, the dismissal may be illegal. Depending on the case, remedies can include reinstatement without loss of seniority rights, full backwages, or separation pay when reinstatement is no longer feasible, plus other relief supported by law and evidence.

If a valid just cause exists but the employer failed to observe statutory due process, the dismissal may remain valid, but the employer can be ordered to pay nominal damages. The Supreme Court’s prevailing benchmark for a just-cause dismissal implemented without proper procedure has been ₱30,000, although liability ultimately depends on the controlling law and disposition of the particular case. See Agabon v. NLRC.

When legal help is urgent

Seek prompt advice from a labor lawyer, union representative, DOLE office, or the NLRC when:

A response or hearing deadline is approaching;
The notice lacks details needed to prepare a defense;
The employee is being forced to resign or sign an admission;
Preventive suspension is unsupported or is nearing or exceeding 30 days;
The case involves large losses, regulated records, senior officers, multiple employees, or possible criminal exposure;
Digital evidence may soon be erased or overwritten;
The employer plans to report the matter to law enforcement or a regulator;
Retaliation, discrimination, union activity, whistleblowing, or data-privacy violations may be involved; or
A termination notice has already been received.

An employee may seek conciliation through DOLE’s Single Entry Approach and, when unresolved, pursue an appropriate complaint before the NLRC. Current filing requirements and channels should be confirmed through the NLRC’s official website and FAQs. Do not delay: different employment and monetary claims may have different prescriptive periods, and internal company deadlines can be much shorter.

Frequently asked questions

Can an employee be dismissed for one falsified record?

Possibly. There is no universal rule that falsification must be repeated. The answer depends on intent, seriousness, work connection, the employee’s duties, the importance of the record, company rules, and the evidence. An isolated innocent error is different from a deliberate falsification involving money, property, safety, regulatory compliance, or a position of trust.

Is an admission required?

No. An employer may rely on substantial circumstantial, documentary, testimonial, or digital evidence. But the evidence must reasonably connect the employee to the misconduct. Mere access, suspicion, or an unexplained discrepancy may be insufficient by itself.

Does the employee have a right to see every document?

Private-sector due process does not necessarily create full court-style discovery. Still, the notice must disclose enough specific facts and circumstances for an intelligent defense. Fairness may require identifying or allowing meaningful access to the material evidence being relied upon, subject to lawful protection of confidential or third-party information.

Must there always be a face-to-face hearing?

No. A meaningful written opportunity to answer may be sufficient. A formal hearing or conference should be held when requested in writing, when substantial evidentiary disputes exist, when company rules or a CBA require it, or when similar circumstances justify one.

May the employee bring a lawyer or union officer?

The employee should be given a reasonable opportunity to consult or be assisted by a lawyer or union representative. The exact participation allowed during an internal conference may depend on the CBA, company rules, and circumstances.

Can the employer suspend system access without suspending employment?

Generally, reasonable security controls may be used to protect records and property during an investigation. They should be proportionate, temporary, and implemented without secretly converting the arrangement into an unpaid suspension, demotion, or constructive dismissal.

Does acquittal in a criminal case automatically invalidate dismissal?

No. Criminal and labor proceedings apply different standards and address different questions. Conversely, a workplace finding does not establish criminal guilt. The evidence supporting the employment decision must be assessed independently.

What if the employee refuses to explain?

The employer may decide on the available evidence after proving that a proper notice and genuine opportunity to respond were given. Refusal to answer does not relieve the employer of the burden to establish a valid cause.

Official legal sources

This article provides general legal information, not advice for a particular case. Outcomes depend on the evidence, employment documents, company rules, collective agreements, and laws applicable to the worker. Legal sources and procedures were checked as of August 27, 2026.