Quick answer

An employer may investigate suspected employee fraud or falsified records and may impose discipline—including dismissal—only if both requirements are met:

There is a valid substantive ground supported by substantial evidence, such as serious misconduct or fraud or willful breach of trust under Article 297 of the Labor Code; and
Procedural due process is observed through a specific written charge, a meaningful opportunity to answer and present evidence, and a written decision after the employee’s defense is considered.

Suspicion, an audit discrepancy, an anonymous accusation, or the employer’s statement that it has “lost confidence” is not automatically enough. The investigation must connect the employee to a real, intentional act. Conversely, due process does not require proof beyond reasonable doubt or a courtroom-style trial. The applicable standard in a labor case is substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.

The controlling rules come principally from the Labor Code of the Philippines, DOLE Department Order No. 147-15, and Supreme Court decisions applying the twin-notice and opportunity-to-be-heard requirements.

What conduct may justify discipline or dismissal?

Fraud or falsification can fall under one or more just causes in Article 297:

Serious misconduct, if the act is grave, work-related, and performed with wrongful intent;
Fraud or willful breach of trust, when an employee intentionally violates trust actually reposed in the employee;
Commission of a crime or offense against the employer, an immediate family member, or the employer’s duly authorized representative, when the statutory requirements apply; or
An analogous cause, if it is similar in nature to the causes expressly listed and was identified in company rules or otherwise properly established.

Examples may include deliberately altering time records, reimbursement documents, sales or inventory records, medical certificates, payroll data, receipts, approvals, customer accounts, or electronic logs. The Supreme Court has recognized that deliberate falsification of time records can constitute serious misconduct and dishonesty or fraud. See Cruz v. NLRC, G.R. No. 142007, March 19, 2001.

But the label “falsification” does not decide the case. The employer must still prove what was changed, who changed or used it, whether the act was intentional, and why it constitutes the charged offense. A clerical error, misunderstanding, system defect, good-faith reliance on another person, or careless but unintentional entry may call for a different assessment.

Fraud and loss of trust are not interchangeable with suspicion

To dismiss for fraud or willful breach of trust, the employer generally must establish:

The employee held a position of trust and confidence; and
The employee committed an act that genuinely justified the loss of trust.

Positions of trust generally include:

Managerial employees whose duties involve management or substantial discretion; and
Fiduciary rank-and-file employees, such as cashiers, auditors, property custodians, or employees who regularly handle significant money or property.

For rank-and-file employees who do not hold a fiduciary position, “loss of trust” should not be used as a catch-all ground. The employer should identify and prove the applicable misconduct or other just cause.

A breach must be willful—intentional, knowing, and purposeful, without a justifiable excuse. Mere carelessness or an ordinary breach does not automatically establish fraud. The loss of trust must have a real factual basis, not rest on speculation or uncorroborated accusations. These principles are discussed in Lima Land, Inc. v. Cuevas, G.R. No. 169523, June 16, 2010 and P.J. Lhuillier, Inc. v. Camacho, G.R. No. 211443, December 1, 2021.

The employer bears the burden of proving a valid cause for dismissal. The required quantum is substantial evidence, not proof beyond reasonable doubt. Still, an accusation unsupported by reliable records, testimony, admissions, audit findings, or other corroborating material may fail even under that standard.

A fair investigation, step by step

1. Secure records without deciding guilt in advance

Once a credible issue appears, the employer should preserve relevant material before it can be altered or lost. Depending on the incident, this may include:

Original paper records and certified copies;
Audit trails, version histories, access logs, and approval records;
Emails, workplace messages, and system-generated reports;
CCTV footage obtained and retained lawfully;
Receipts, vouchers, inventory records, bank or payment confirmations;
Specimen signatures or authenticated comparison documents;
Witness accounts based on personal knowledge; and
Written records of when, where, and from whom each item was obtained.

Preserve the original format, metadata, and chain of custody where feasible. Investigators should document who collected, copied, transferred, or examined each record. Screenshots alone can omit context; retain the underlying file or system export when available.

The investigator should test alternative explanations and examine potentially exculpatory material, not merely assemble evidence supporting a predetermined dismissal.

2. Control access and respect data privacy

An internal investigation may involve personal information. The Data Privacy Act of 2012 and its Implementing Rules and Regulations require lawful, fair, and proportionate processing.

Employers should:

Collect only information reasonably relevant to the investigation;
Limit access to personnel with a legitimate need to know;
Use secure transfer and storage methods;
Avoid public accusations or unnecessary disclosure;
Follow applicable privacy notices and retention policies; and
Apply additional safeguards to sensitive personal information.

An employer’s legitimate interest may support some processing, but it is not unlimited. The necessity of the processing and the employee’s rights must still be considered. Secret access to personal accounts, devices, or communications can raise separate privacy, cybercrime, evidentiary, and contractual issues. Legal advice is prudent before collecting material outside employer-controlled systems.

3. Issue a detailed first written notice

Before dismissal for just cause, the employee must receive a written notice—commonly called a notice to explain or NTE—that states:

The specific acts or omissions being investigated;
Relevant dates, transactions, records, and circumstances;
The employee’s alleged participation;
The company rules allegedly violated, if any;
The particular just cause or causes under Article 297 being considered; and
The deadline and method for submitting an explanation and supporting evidence.

A generic allegation such as “fraud,” “dishonesty,” or “loss of trust” is inadequate if it does not allow an intelligent response. The first notice should not announce that guilt or dismissal has already been decided.

Under King of Kings Transport, Inc. v. Mamac, G.R. No. 166208, June 29, 2007, a reasonable opportunity to answer means at least five calendar days from receipt of the notice. The period gives the employee time to study the charge, consult a union representative or lawyer, collect records, and prepare a defense. A company policy or collective bargaining agreement may require a longer period or additional steps.

Service should be documented. If the employee refuses to receive the notice or cannot be reached, the employer should use reasonable, provable methods authorized by its rules and applicable law rather than simply treating the notice as unnecessary.

4. Give a meaningful opportunity to respond

The employee should be permitted to:

Give a written explanation;
Identify witnesses and submit relevant records;
Explain disputed signatures, entries, credentials, or system access;
Point out missing context, inconsistent data, or possible system errors;
Respond to the material facts relied upon; and
Obtain assistance from a representative, if desired and permitted by the governing rules.

A formal hearing is not required in every case. A meaningful written opportunity may satisfy due process. However, a hearing or conference becomes mandatory when:

The employee requests one in writing;
Substantial evidentiary disputes exist;
A company rule, established practice, or collective bargaining agreement requires one; or
Comparable circumstances make a conference necessary for a fair resolution.

This rule is explained in Perez v. Philippine Telegraph and Telephone Company, G.R. No. 152048, April 7, 2009 and Eagle Clarc Shipping Philippines, Inc. v. NLRC, G.R. No. 225125, June 6, 2018.

If new, material accusations emerge during the inquiry, fairness generally requires that they be put to the employee with another reasonable opportunity to answer. An employer should not dismiss an employee for an uncharged incident first disclosed in the final decision.

5. Evaluate the evidence impartially

The decision-maker should separately determine:

Whether the disputed record is false or materially misleading;
Whether the employee created, altered, approved, submitted, or knowingly used it;
Whether the conduct was intentional;
Whether the employee’s explanation is supported or contradicted by reliable evidence;
Whether the act is work-related and sufficiently serious;
Whether the position actually involved the trust claimed by the employer;
Whether company rules were communicated and consistently applied; and
Whether the penalty is proportionate under the facts and governing policies.

An investigator’s conclusion, audit memorandum, or handwriting comparison should not be treated as infallible merely because it is written in formal language. The underlying facts and method must support the conclusion.

The employer need not wait for a criminal conviction before completing a labor investigation. A criminal case and an employment case apply different standards and may proceed independently. Likewise, dismissal of a criminal complaint does not automatically establish that an employment dismissal was lawful or unlawful.

6. Issue a written decision

If discipline or dismissal is imposed, the second written notice should:

Identify the charge or charges found established;
State the material facts and evidence relied upon;
Address the employee’s principal defenses;
Identify the applicable rule and legal ground;
State the sanction and its effective date; and
Explain any internal appeal or grievance process.

For dismissal, the notice must show that the employer considered all the circumstances and found a just cause. It should not rely on vague assertions or grounds materially different from those in the first notice.

If the evidence is insufficient, the employer should close the case or impose only a lawful, proportionate measure supported by the facts and company rules. An inconclusive investigation is not proof of fraud.

Can the employee be preventively suspended?

Yes, but only in limited circumstances. Preventive suspension is a protective measure, not a penalty. It may be imposed when the employee’s continued presence creates a serious and imminent threat to the life or property of the employer or co-workers—for example, where continued system or records access presents a concrete risk to company property or evidence.

Preventive suspension generally may not exceed 30 days. After that, the employer must reinstate the employee to the former or a substantially equivalent position, or extend the suspension while paying the wages and benefits due during the extension. Amounts paid during a lawful extension are not reimbursable merely because the employee is later dismissed.

The employer should state the specific threat, scope, and start date in writing. A bare accusation of fraud does not automatically justify suspension. The governing limits are discussed in Maula v. Ximex Delivery Express, Inc., G.R. No. 207838, January 25, 2017 and Career Philippines Shipmanagement, Inc. v. Serna, G.R. No. 227718, November 11, 2021.

Less restrictive safeguards may sometimes be sufficient, such as temporarily removing approval authority, preserving accounts, changing access rights, transferring custody of records, or assigning non-sensitive duties. Any measure should avoid humiliation, retaliation, or an appearance that guilt has already been decided.

What if the employee does not answer?

Failure to answer after proper notice and a genuine opportunity does not automatically prove the accusation. The employer may decide on the available evidence, but it must still establish a valid cause through substantial evidence.

Silence should not be used to cure a defective notice, missing evidence, an unreasonably short deadline, or failure to serve the charge. If the employee seeks a reasonable extension for records, representation, illness, or another legitimate reason, the employer should consider it in good faith.

Consequences of getting due process wrong

The result depends on what the employer failed to prove:

No valid substantive cause: The dismissal is illegal even if notices and a hearing were provided. Remedies may include reinstatement without loss of seniority rights, full back wages, and other relief allowed by law.
Valid cause, but defective procedure: The dismissal may remain valid, but the employer may be liable for nominal damages. In Agabon v. NLRC, G.R. No. 158693, November 17, 2004, the Supreme Court fixed nominal damages at ₱30,000 for a just-cause dismissal implemented without statutory due process.
Unjustified preventive suspension: The employer may face liability for wages or other relief, depending on the circumstances.
Bad-faith or oppressive conduct: Separate damages may be considered only when the required factual and legal basis is proven.

The ₱30,000 Agabon amount is not a fee that allows an employer to “dismiss now and investigate later.” It addresses a procedural violation only where a valid substantive cause was independently established.

Evidence employees should preserve

An employee who receives an NTE, suspension notice, or termination decision should retain:

The complete notices and proof of when each was received;
The employee handbook, code of conduct, and relevant policies;
The employment contract and job description;
The collective bargaining agreement, if applicable;
Written explanations and proof of submission;
Emails, workplace messages, logs, schedules, approvals, and source records;
Requests for documents, extensions, representation, or a hearing;
Meeting invitations, minutes, recordings lawfully made, and witness details;
Payslips and records of withheld pay or benefits; and
The final decision, clearance documents, and communications about separation.

Do not alter, delete, fabricate, or take records unlawfully. Preserve material already lawfully accessible and request copies through proper channels. Keep a dated chronology while events are fresh.

Common mistakes to avoid

For employers

Treating an audit discrepancy as conclusive proof of fraud;
Using vague NTEs or providing less than five calendar days to answer;
Charging one incident but dismissing for another;
Withholding the evidence or factual detail needed for a meaningful response;
Treating refusal to confess as proof of guilt;
Ignoring evidence that supports the employee;
Using “loss of trust” for an employee who does not occupy a position of trust;
Imposing preventive suspension automatically or beyond 30 days without pay;
Allowing the accuser to be the sole investigator and final decision-maker where bias can reasonably be avoided;
Disclosing allegations to uninvolved personnel; or
Skipping procedures required by a handbook or collective bargaining agreement.

For employees

Ignoring the NTE or relying only on an oral denial;
Missing the response deadline without requesting an extension;
Signing an admission, resignation, or quitclaim without reading it;
Deleting messages or modifying disputed files;
Making unsupported counter-accusations;
Assuming a pending or dismissed criminal complaint automatically decides the labor issue; or
Waiting too long to seek assistance.

When legal help is urgent

Consult a labor lawyer, union representative, or appropriate government office promptly when:

Dismissal appears predetermined;
The NTE is vague or allows fewer than five calendar days;
Access to essential evidence is being denied;
The employee is pressured to resign, confess, or sign a waiver;
Preventive suspension approaches or exceeds 30 days;
The case involves significant financial loss, digital forensics, sensitive personal data, or possible criminal charges;
Retaliation, discrimination, or union-related issues may be involved;
A collective bargaining agreement has short grievance deadlines; or
A termination notice has already been served.

Most labor and employment disputes must first undergo mandatory conciliation-mediation through DOLE’s Single Entry Approach before they proceed to the proper labor forum, subject to statutory exceptions. See Republic Act No. 10396. An illegal-dismissal action generally prescribes in four years, while many money claims arising from employment prescribe in three years. Shorter contractual or CBA grievance periods may require much earlier action. Current procedural materials are available from the National Labor Relations Commission and its 2025 NLRC Rules of Procedure.

Frequently asked questions

Is an actual administrative hearing always required?

No. A meaningful opportunity to submit a written explanation and evidence may be sufficient. A conference or hearing is required when requested by the employee in writing, when substantial factual disputes exist, when company rules or a CBA require it, or when similar circumstances make it necessary.

Must the employer disclose every document in its possession?

Labor due process is not identical to court discovery. However, the employee must receive enough specific factual information to understand and answer the charge. Withholding the material basis of the accusation can make the opportunity to respond meaningless.

Can an employee be dismissed for one falsified document?

Potentially, yes. There is no universal minimum number of incidents. The employer must still prove intentional conduct, the applicable just cause, and the seriousness of the offense. The nature of the document, the employee’s role, the harm or risk created, and the governing rules all matter.

Does a small amount make falsification harmless?

Not necessarily. Deliberate dishonesty may be serious even when the amount is small, particularly in a fiduciary position. But the employer must still prove the act and consider all relevant circumstances; the amount alone neither establishes nor defeats just cause.

Is an anonymous report enough to dismiss an employee?

Ordinarily, no. It may justify a preliminary inquiry, but dismissal requires substantial evidence connecting the employee to the charged conduct. The report should be corroborated by reliable records, testimony, admissions, or other evidence.

May the employer file a criminal complaint at the same time?

Yes, if there is a factual and legal basis. Internal discipline, an NLRC case, and a criminal proceeding are distinct. A criminal allegation should not be used merely to pressure an employee into resigning or waiving labor rights.

Can an employee bring a lawyer or union representative?

The employee may seek assistance from a representative. The applicable company rules, CBA, and circumstances determine participation in an internal conference. The employee should make the request in writing, especially where dismissal or criminal exposure is possible.

Can the company inspect work email or system logs?

It may examine employer-controlled systems when supported by a lawful purpose and applicable policies, but collection and use must still comply with privacy, proportionality, security, and access-control requirements. Personal accounts or devices raise additional legal issues.

Official sources

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Fraud, falsification, loss-of-trust, privacy, and dismissal issues depend heavily on the employee’s duties, the actual documents and evidence, company rules, any collective bargaining agreement, and how the investigation was conducted. Official sources and current procedures were checked as of August 30, 2026.