Quick answer
An employer may investigate suspected employee fraud or falsified company records, but dismissal is lawful only if both substantive cause and procedural due process are established.
For private-sector employment, fraud or a willful breach of the employer’s trust may be a just cause for dismissal under Article 297(c) of the Labor Code. Serious, work-related falsification may also constitute serious misconduct or another applicable just cause. However, an accusation, audit discrepancy, anonymous report, or general claim of “loss of confidence” is not enough. The employer must establish the employee’s responsibility through substantial evidence and must give the employee specific written notice and a meaningful opportunity to answer before deciding the case.
The usual process is:
- Secure the records and conduct a neutral preliminary fact-finding review.
- Issue a detailed notice to explain.
- Give the employee at least five calendar days from receipt to prepare a response.
- Hold a conference when requested in writing, required by company rules or a collective bargaining agreement, or necessary because material facts are disputed.
- Evaluate all evidence, including the employee’s explanation.
- Issue a separate written decision stating the findings and penalty.
Preventive suspension is permitted only when the employee’s continued presence poses a serious and imminent threat to life or property. It generally cannot exceed 30 days unless the employee is reinstated or the extension is paid.
When fraud or falsification can justify dismissal
Article 297 of the Labor Code of the Philippines recognizes several just causes that may be relevant to falsified records:
- Serious misconduct connected with the employee’s work;
- Fraud or willful breach of the trust reposed in the employee;
- Commission of a crime or offense against the employer, an immediate family member of the employer, or the employer’s duly authorized representative; or
- A cause truly analogous to the statutory grounds.
Examples that may justify discipline, depending on the evidence and circumstances, include deliberately altering time records, fabricating receipts or liquidation documents, creating fictitious transactions, manipulating inventory or accounting entries, using forged approval documents, or knowingly entering false information to obtain money or conceal a shortage.
The Supreme Court has specifically recognized that proven falsification of time records can constitute serious misconduct and dishonesty or fraud. That result is not automatic in every disputed time-record case: intent, authenticity, responsibility for the entry, applicable rules, and the reliability of the evidence still matter. See Caingat v. National Labor Relations Commission, G.R. No. 142007, March 14, 2001.
A careless entry, honest accounting mistake, unclear procedure, system malfunction, disputed authorization, or error made without wrongful intent should not simply be relabeled as fraud. Willful breach means an act done intentionally, knowingly, and purposely, without a justifiable excuse—not merely carelessly or inadvertently. The alleged act must also be work-related and must show that the employee has become unfit to continue working for the employer. See Jalit v. Cargo Safeway, Inc., G.R. No. 238147, September 29, 2021.
“Loss of trust and confidence” has legal limits
An employer cannot dismiss someone by merely stating that trust has been lost. To rely on fraud or willful breach of trust, the employer generally must show:
- The employee occupied a position of trust and confidence; and
- The employee committed an act that provides a genuine basis for the loss of trust.
Positions of trust commonly include:
- Managerial employees who exercise substantial management authority; and
- Fiduciary rank-and-file employees who regularly handle significant money, property, records, or other sensitive assets, such as cashiers, auditors, and property custodians.
Job titles alone are not conclusive. The employee’s actual functions, access, authority, and responsibilities must be examined.
Even for a managerial employee, loss of trust must rest on substantial evidence rather than suspicion, rumor, pressure from a customer, or speculative inferences. The employer should identify the employee’s own participation instead of relying solely on the fact that the employee supervised the department where the irregularity occurred.
What level of proof is required?
The employer does not have to prove an internal disciplinary charge beyond reasonable doubt. An employment investigation is not a criminal trial. The applicable administrative standard is generally substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.
Nevertheless, substantial evidence requires more than an unverified allegation. Depending on the case, reliable evidence may include:
- Original or properly preserved electronic records;
- Audit trails and system-access logs;
- Authenticated attendance, payroll, inventory, accounting, or transaction records;
- Approval workflows and user-access records;
- Contemporaneous emails, messages, or written instructions;
- Witness statements based on personal knowledge;
- CCTV footage lawfully obtained and preserved;
- Signature or document comparisons supported by competent evidence;
- Admissions that were voluntarily and clearly made; and
- Evidence showing who had access, when the alteration occurred, and what benefit or concealment resulted.
The employer bears the burden of proving the legality of a dismissal. Evidence must therefore be assessed for reliability and consistency, including evidence that supports the employee’s explanation. The Supreme Court’s discussion of the substantial-evidence requirement appears in Intercontinental Broadcasting Corporation v. Guerrero, G.R. No. 229013, July 15, 2020.
A fair investigation process
1. Preserve records without deciding guilt in advance
The employer should promptly secure relevant records, restrict further unauthorized changes, and document who collected each item and when. Original files should be preserved where possible. Investigators should work from copies and record any extraction, conversion, or transfer.
Immediate security measures should be proportionate. Access to particular systems, funds, inventory, or records may be temporarily limited when necessary, but the employer should avoid announcing that the employee is guilty before the investigation is completed.
Investigators should also identify potentially exculpatory material, such as shared credentials, system errors, approval messages, access by other users, unclear procedures, or corrections made under a supervisor’s instruction.
2. Conduct preliminary fact-finding
Before issuing a formal charge, determine:
- What record or transaction is allegedly false;
- What entry is accurate and what entry is disputed;
- Who created, approved, edited, or benefited from it;
- When and how the suspected alteration occurred;
- Which job duty, company policy, or legal ground may have been violated;
- Whether the conduct appears intentional or could reasonably be accidental; and
- Whether other employees with comparable involvement are being treated consistently.
An investigator who is a complainant or direct participant should not be the sole decision-maker where a more neutral arrangement is reasonably available.
3. Issue a specific first written notice
The first notice—often called a notice to explain or show-cause notice—should not merely say “fraud,” “dishonesty,” or “loss of confidence.” It should contain enough detail for an intelligent response, including:
- The specific acts or omissions charged;
- Relevant dates, transactions, amounts, documents, or record entries;
- The employee’s alleged participation;
- The company rule allegedly violated, if any;
- The applicable just cause under Article 297 being considered;
- A direction to submit a written explanation;
- The deadline and method for submission; and
- Notice that dismissal or another disciplinary penalty may be imposed if warranted.
The employer need not disclose privileged legal advice or compromise confidential information unnecessarily. But it should provide or reasonably identify the material evidence needed for the employee to understand and answer the accusation.
4. Allow at least five calendar days
The employee should receive at least five calendar days from receipt of the first notice to study the accusation, consult a union representative or lawyer, gather records, and prepare a defense.
A deadline shorter than five calendar days creates a serious due-process risk. Additional time may be appropriate when the records are extensive, the employee is ill, critical documents are controlled by the employer, or another genuine obstacle prevents a meaningful response.
The five-day standard and the required detail in the first notice are explained in King of Kings Transport, Inc. v. Mamac, G.R. No. 166208, June 29, 2007.
5. Provide a meaningful opportunity to be heard
The employee may respond in writing, submit documents, identify witnesses, explain disputed entries, challenge authenticity, and raise inconsistent treatment or procedural defects.
A courtroom-style hearing is not required in every case. A formal hearing or conference becomes especially important when:
- The employee requests one in writing;
- Material factual or evidentiary disputes exist;
- A company rule, established practice, or collective bargaining agreement requires it; or
- Comparable circumstances make a conference necessary for a fair evaluation.
At a conference, the employee should be allowed to explain and clarify the defense, present supporting evidence, and answer the employer’s evidence. Assistance by a union representative, chosen representative, or counsel should be allowed where applicable.
Written submissions can satisfy the opportunity-to-be-heard requirement when they provide a genuine chance to contest the charge. See Perez v. Philippine Telegraph and Telephone Company, G.R. No. 152048, April 7, 2009.
An employee’s silence or refusal to participate does not permit a predetermined result. The employer must still evaluate the available evidence and prove a valid cause.
6. Decide only after considering the defense
The decision-maker should compare the charge with the evidence and determine:
- Whether the disputed act actually occurred;
- Whether the employee was responsible;
- Whether the conduct was intentional;
- Whether it was work-related;
- Whether the cited company rule was communicated and applicable;
- Whether the employee’s position involved the trust allegedly breached;
- Whether similar cases were handled consistently;
- Whether dismissal is proportionate; and
- Whether mitigating or aggravating circumstances affect the penalty.
Past infractions may be considered only if properly established and relevant under the company’s rules and applicable law. An employer should not rely on a new accusation that the employee never had a chance to answer. If the investigation reveals a materially different charge, a supplemental notice and another opportunity to respond may be necessary.
7. Issue a separate written decision
If a violation is established, the employer should issue a second written notice stating:
- The charge or charges evaluated;
- The material findings;
- That the employee’s explanation and evidence were considered;
- The rule and legal ground applied;
- The penalty and its effective date; and
- Any return-of-property, final-pay, or clearance instructions that lawfully apply.
A notice that simply says “management has lost confidence” without explaining the established basis is vulnerable to challenge.
Preventive suspension during the investigation
Preventive suspension is not supposed to be a punishment. It is a protective measure available only when continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. In a records-falsification case, the employer should be able to explain why continued access creates an imminent property risk—for example, a real ability to alter evidence, manipulate accounts, release funds, or repeat the suspected transaction.
The initial preventive suspension generally may not exceed 30 days. After that period, the employer must:
- Reinstate the employee to the former or a substantially equivalent position; or
- Extend the suspension while paying the wages and benefits due during the extension.
If the employee is eventually dismissed, wages paid during a lawful extension are not reimbursable by the employee. An indefinite unpaid suspension or failure to recall the employee after the allowable period may amount to constructive dismissal. These rules are discussed in Lagamayo v. CGI Philippines, Inc., G.R. No. 227718, November 11, 2021.
A temporary reassignment, leave arrangement, or access restriction should not be used to evade these safeguards or unlawfully reduce pay or rank.
Evidence each side should preserve
For the employer
Preserve:
- Original and forensic copies of disputed records;
- Audit reports and the underlying data, not only conclusions;
- File metadata, version history, access logs, and approval records;
- Written policies and proof that they were communicated;
- Job descriptions and authority matrices;
- Notices, proof of service, responses, and meeting minutes;
- Witness statements identifying the basis of personal knowledge;
- Documents supporting both incriminating and exculpatory findings; and
- A clear timeline of the investigation and decision.
Avoid altering original files, sharing accusations widely, coaching witnesses, relying on unidentified hearsay, or obtaining evidence through unlawful access to personal accounts.
For the employee
Preserve lawfully accessible copies of:
- The notice to explain and proof of the date received;
- The written response and proof of submission;
- Relevant policies, job descriptions, and approval procedures;
- Emails, messages, work instructions, and authorizations;
- System-error reports, correction requests, or access-sharing evidence;
- Payslips and preventive-suspension notices;
- Requests for documents, extensions, or a formal conference;
- Names of witnesses with direct knowledge; and
- The final decision and proof of receipt.
Do not delete, alter, conceal, or take confidential company data unrelated to the defense. If access has been disabled, identify the needed records in writing and request a reasonable opportunity to inspect or obtain the relevant portions.
Common mistakes
Mistakes employers should avoid
- Treating an audit variance as automatic proof of fraud;
- Using a vague notice that does not identify the disputed acts;
- Giving fewer than five calendar days to respond;
- Deciding the penalty before receiving the explanation;
- Charging one offense but dismissing for a materially different one;
- Assuming that a managerial title alone proves breach of trust;
- Relying on shared credentials without determining who performed the act;
- Ignoring evidence favorable to the employee;
- Imposing preventive suspension without an imminent threat;
- Letting unpaid preventive suspension exceed 30 days;
- Skipping procedures required by a collective bargaining agreement; or
- Filing or threatening a criminal case merely to force a resignation or waiver.
Mistakes employees should avoid
- Ignoring the notice or answering only through an emotional denial;
- Missing the deadline without requesting an extension in writing;
- Resigning immediately without understanding the consequences;
- Signing an admission, resignation, or quitclaim without reading it;
- Altering or deleting disputed records;
- Taking confidential files indiscriminately;
- Contacting witnesses in a way that could appear coercive; or
- Assuming that no criminal conviction means dismissal is impossible.
Company discipline and criminal proceedings are separate
Internal discipline, an illegal-dismissal case, and a criminal complaint involve different issues and standards. An employer does not always need a criminal conviction—or even a filed criminal case—before imposing employment discipline supported by substantial evidence.
Conversely, an internal finding of fraud does not automatically establish criminal liability. Criminal falsification, estafa, or related offenses have statutory elements that prosecutors and courts must evaluate under the higher criminal standard of proof. Employers should avoid describing an employee publicly as a criminal based only on an internal allegation.
If law enforcement, forensic examination, substantial financial loss, or possible criminal exposure is involved, both sides should obtain independent legal advice before giving statements or turning over devices and records.
If due process is violated
A dismissal without a valid substantive cause may be declared illegal. Depending on the facts and final adjudication, remedies can include reinstatement without loss of seniority rights and full backwages, or separation pay when reinstatement is no longer feasible.
If a valid just cause is proven but the employer failed to observe the required procedure, the dismissal may remain effective, but the employer can be ordered to pay nominal damages. Supreme Court decisions commonly apply ₱30,000 for a procedurally defective dismissal based on just cause, subject to controlling jurisprudence and the circumstances adjudicated.
Employees may seek assistance through the DOLE Single Entry Approach and, if unresolved, file the appropriate case before the National Labor Relations Commission. The NLRC website provides official offices, contact information, rules, and case guidance. Illegal-dismissal claims generally prescribe in four years, while many employment money claims prescribe in three years; waiting is risky because the correct period and tolling rules depend on the particular claim.
When legal help is urgent
Seek prompt advice from a Philippine labor lawyer, union representative, DOLE office, or the Public Attorney’s Office if applicable when:
- A response deadline is approaching;
- The notice is vague but dismissal is threatened;
- The employee is asked to sign a confession, resignation, or quitclaim;
- Preventive suspension is nearing or has exceeded 30 days;
- Payroll, bank, tax, government, or customer records are involved;
- A criminal complaint, arrest, search, or device seizure is threatened;
- Evidence may be deleted or overwritten;
- Several employees used the same account or credentials;
- The investigation involves retaliation, discrimination, or union activity;
- A collective bargaining agreement imposes additional procedures; or
- A dismissal notice has already been received.
Frequently asked questions
Can an employee be dismissed for one falsified record?
Possibly. A single deliberate falsification can be serious enough to justify dismissal, particularly when it directly concerns the employee’s duties or betrays a position of trust. The employer must still prove responsibility and wrongful intent, follow due process, and show that dismissal is proportionate under the circumstances.
Is an admission required?
No. Fraud may be established through substantial circumstantial or documentary evidence. But silence, refusal to sign a notice, or failure to explain is not itself conclusive proof that the underlying accusation is true.
Can the employee refuse to sign the notice?
A signature may acknowledge receipt without admitting the charge. The employee may write “received only” with the date if appropriate. Refusing to sign generally does not stop the process if the employer can reliably prove service.
Must the employer reveal the identity of every informant?
Not invariably. Confidentiality and safety may justify limits, but the employee must still receive enough detail and material information to answer the accusation meaningfully. A dismissal based entirely on an unidentified, untested accusation is difficult to sustain without corroborating evidence.
Is a face-to-face hearing always required?
No. A
Quick answer
An employer may investigate suspected employee fraud or falsified company records, but dismissal is lawful only if both substantive cause and procedural due process are established.
For private-sector employment, fraud or a willful breach of the employer’s trust may be a just cause for dismissal under Article 297(c) of the Labor Code. Serious, work-related falsification may also constitute serious misconduct or another applicable just cause. However, an accusation, audit discrepancy, anonymous report, or general claim of “loss of confidence” is not enough. The employer must establish the employee’s responsibility through substantial evidence and must give the employee specific written notice and a meaningful opportunity to answer before deciding the case.
The usual process is:
- Secure the records and conduct a neutral preliminary fact-finding review.
- Issue a detailed notice to explain.
- Give the employee at least five calendar days from receipt to prepare a response.
- Hold a conference when requested in writing, required by company rules or a collective bargaining agreement, or necessary because material facts are disputed.
- Evaluate all evidence, including the employee’s explanation.
- Issue a separate written decision stating the findings and penalty.
Preventive suspension is permitted only when the employee’s continued presence poses a serious and imminent threat to life or property. It generally cannot exceed 30 days unless the employee is reinstated or the extension is paid.
When fraud or falsification can justify dismissal
Article 297 of the Labor Code of the Philippines recognizes several just causes that may be relevant to falsified records:
- Serious misconduct connected with the employee’s work;
- Fraud or willful breach of the trust reposed in the employee;
- Commission of a crime or offense against the employer, an immediate family member of the employer, or the employer’s duly authorized representative; or
- A cause truly analogous to the statutory grounds.
Examples that may justify discipline, depending on the evidence and circumstances, include deliberately altering time records, fabricating receipts or liquidation documents, creating fictitious transactions, manipulating inventory or accounting entries, using forged approval documents, or knowingly entering false information to obtain money or conceal a shortage.
The Supreme Court has specifically recognized that proven falsification of time records can constitute serious misconduct and dishonesty or fraud. That result is not automatic in every disputed time-record case: intent, authenticity, responsibility for the entry, applicable rules, and the reliability of the evidence still matter. See Caingat v. National Labor Relations Commission, G.R. No. 142007, March 14, 2001.
A careless entry, honest accounting mistake, unclear procedure, system malfunction, disputed authorization, or error made without wrongful intent should not simply be relabeled as fraud. Willful breach means an act done intentionally, knowingly, and purposely, without a justifiable excuse—not merely carelessly or inadvertently. The alleged act must also be work-related and must show that the employee has become unfit to continue working for the employer. See Jalit v. Cargo Safeway, Inc., G.R. No. 238147, September 29, 2021.
“Loss of trust and confidence” has legal limits
An employer cannot dismiss someone by merely stating that trust has been lost. To rely on fraud or willful breach of trust, the employer generally must show:
- The employee occupied a position of trust and confidence; and
- The employee committed an act that provides a genuine basis for the loss of trust.
Positions of trust commonly include:
- Managerial employees who exercise substantial management authority; and
- Fiduciary rank-and-file employees who regularly handle significant money, property, records, or other sensitive assets, such as cashiers, auditors, and property custodians.
Job titles alone are not conclusive. The employee’s actual functions, access, authority, and responsibilities must be examined.
Even for a managerial employee, loss of trust must rest on substantial evidence rather than suspicion, rumor, pressure from a customer, or speculative inferences. The employer should identify the employee’s own participation instead of relying solely on the fact that the employee supervised the department where the irregularity occurred.
What level of proof is required?
The employer does not have to prove an internal disciplinary charge beyond reasonable doubt. An employment investigation is not a criminal trial. The applicable administrative standard is generally substantial evidence—relevant evidence that a reasonable mind might accept as adequate to support a conclusion.
Nevertheless, substantial evidence requires more than an unverified allegation. Depending on the case, reliable evidence may include:
- Original or properly preserved electronic records;
- Audit trails and system-access logs;
- Authenticated attendance, payroll, inventory, accounting, or transaction records;
- Approval workflows and user-access records;
- Contemporaneous emails, messages, or written instructions;
- Witness statements based on personal knowledge;
- CCTV footage lawfully obtained and preserved;
- Signature or document comparisons supported by competent evidence;
- Admissions that were voluntarily and clearly made; and
- Evidence showing who had access, when the alteration occurred, and what benefit or concealment resulted.
The employer bears the burden of proving the legality of a dismissal. Evidence must therefore be assessed for reliability and consistency, including evidence that supports the employee’s explanation. The Supreme Court’s discussion of the substantial-evidence requirement appears in Intercontinental Broadcasting Corporation v. Guerrero, G.R. No. 229013, July 15, 2020.
A fair investigation process
1. Preserve records without deciding guilt in advance
The employer should promptly secure relevant records, restrict further unauthorized changes, and document who collected each item and when. Original files should be preserved where possible. Investigators should work from copies and record any extraction, conversion, or transfer.
Immediate security measures should be proportionate. Access to particular systems, funds, inventory, or records may be temporarily limited when necessary, but the employer should avoid announcing that the employee is guilty before the investigation is completed.
Investigators should also identify potentially exculpatory material, such as shared credentials, system errors, approval messages, access by other users, unclear procedures, or corrections made under a supervisor’s instruction.
2. Conduct preliminary fact-finding
Before issuing a formal charge, determine:
- What record or transaction is allegedly false;
- What entry is accurate and what entry is disputed;
- Who created, approved, edited, or benefited from it;
- When and how the suspected alteration occurred;
- Which job duty, company policy, or legal ground may have been violated;
- Whether the conduct appears intentional or could reasonably be accidental; and
- Whether other employees with comparable involvement are being treated consistently.
An investigator who is a complainant or direct participant should not be the sole decision-maker where a more neutral arrangement is reasonably available.
3. Issue a specific first written notice
The first notice—often called a notice to explain or show-cause notice—should not merely say “fraud,” “dishonesty,” or “loss of confidence.” It should contain enough detail for an intelligent response, including:
- The specific acts or omissions charged;
- Relevant dates, transactions, amounts, documents, or record entries;
- The employee’s alleged participation;
- The company rule allegedly violated, if any;
- The applicable just cause under Article 297 being considered;
- A direction to submit a written explanation;
- The deadline and method for submission; and
- Notice that dismissal or another disciplinary penalty may be imposed if warranted.
The employer need not disclose privileged legal advice or compromise confidential information unnecessarily. But it should provide or reasonably identify the material evidence needed for the employee to understand and answer the accusation.
4. Allow at least five calendar days
The employee should receive at least five calendar days from receipt of the first notice to study the accusation, consult a union representative or lawyer, gather records, and prepare a defense.
A deadline shorter than five calendar days creates a serious due-process risk. Additional time may be appropriate when the records are extensive, the employee is ill, critical documents are controlled by the employer, or another genuine obstacle prevents a meaningful response.
The five-day standard and the required detail in the first notice are explained in King of Kings Transport, Inc. v. Mamac, G.R. No. 166208, June 29, 2007.
5. Provide a meaningful opportunity to be heard
The employee may respond in writing, submit documents, identify witnesses, explain disputed entries, challenge authenticity, and raise inconsistent treatment or procedural defects.
A courtroom-style hearing is not required in every case. A formal hearing or conference becomes especially important when:
- The employee requests one in writing;
- Material factual or evidentiary disputes exist;
- A company rule, established practice, or collective bargaining agreement requires it; or
- Comparable circumstances make a conference necessary for a fair evaluation.
At a conference, the employee should be allowed to explain and clarify the defense, present supporting evidence, and answer the employer’s evidence. Assistance by a union representative, chosen representative, or counsel should be allowed where applicable.
Written submissions can satisfy the opportunity-to-be-heard requirement when they provide a genuine chance to contest the charge. See Perez v. Philippine Telegraph and Telephone Company, G.R. No. 152048, April 7, 2009.
An employee’s silence or refusal to participate does not permit a predetermined result. The employer must still evaluate the available evidence and prove a valid cause.
6. Decide only after considering the defense
The decision-maker should compare the charge with the evidence and determine:
- Whether the disputed act actually occurred;
- Whether the employee was responsible;
- Whether the conduct was intentional;
- Whether it was work-related;
- Whether the cited company rule was communicated and applicable;
- Whether the employee’s position involved the trust allegedly breached;
- Whether similar cases were handled consistently;
- Whether dismissal is proportionate; and
- Whether mitigating or aggravating circumstances affect the penalty.
Past infractions may be considered only if properly established and relevant under the company’s rules and applicable law. An employer should not rely on a new accusation that the employee never had a chance to answer. If the investigation reveals a materially different charge, a supplemental notice and another opportunity to respond may be necessary.
7. Issue a separate written decision
If a violation is established, the employer should issue a second written notice stating:
- The charge or charges evaluated;
- The material findings;
- That the employee’s explanation and evidence were considered;
- The rule and legal ground applied;
- The penalty and its effective date; and
- Any return-of-property, final-pay, or clearance instructions that lawfully apply.
A notice that simply says “management has lost confidence” without explaining the established basis is vulnerable to challenge.
Preventive suspension during the investigation
Preventive suspension is not supposed to be a punishment. It is a protective measure available only when continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. In a records-falsification case, the employer should be able to explain why continued access creates an imminent property risk—for example, a real ability to alter evidence, manipulate accounts, release funds, or repeat the suspected transaction.
The initial preventive suspension generally may not exceed 30 days. After that period, the employer must:
- Reinstate the employee to the former or a substantially equivalent position; or
- Extend the suspension while paying the wages and benefits due during the extension.
If the employee is eventually dismissed, wages paid during a lawful extension are not reimbursable by the employee. An indefinite unpaid suspension or failure to recall the employee after the allowable period may amount to constructive dismissal. These rules are discussed in Lagamayo v. CGI Philippines, Inc., G.R. No. 227718, November 11, 2021.
A temporary reassignment, leave arrangement, or access restriction should not be used to evade these safeguards or unlawfully reduce pay or rank.
Evidence each side should preserve
For the employer
Preserve:
- Original and forensic copies of disputed records;
- Audit reports and the underlying data, not only conclusions;
- File metadata, version history, access logs, and approval records;
- Written policies and proof that they were communicated;
- Job descriptions and authority matrices;
- Notices, proof of service, responses, and meeting minutes;
- Witness statements identifying the basis of personal knowledge;
- Documents supporting both incriminating and exculpatory findings; and
- A clear timeline of the investigation and decision.
Avoid altering original files, sharing accusations widely, coaching witnesses, relying on unidentified hearsay, or obtaining evidence through unlawful access to personal accounts.
For the employee
Preserve lawfully accessible copies of:
- The notice to explain and proof of the date received;
- The written response and proof of submission;
- Relevant policies, job descriptions, and approval procedures;
- Emails, messages, work instructions, and authorizations;
- System-error reports, correction requests, or access-sharing evidence;
- Payslips and preventive-suspension notices;
- Requests for documents, extensions, or a formal conference;
- Names of witnesses with direct knowledge; and
- The final decision and proof of receipt.
Do not delete, alter, conceal, or take confidential company data unrelated to the defense. If access has been disabled, identify the needed records in writing and request a reasonable opportunity to inspect or obtain the relevant portions.
Common mistakes
Mistakes employers should avoid
- Treating an audit variance as automatic proof of fraud;
- Using a vague notice that does not identify the disputed acts;
- Giving fewer than five calendar days to respond;
- Deciding the penalty before receiving the explanation;
- Charging one offense but dismissing for a materially different one;
- Assuming that a managerial title alone proves breach of trust;
- Relying on shared credentials without determining who performed the act;
- Ignoring evidence favorable to the employee;
- Imposing preventive suspension without an imminent threat;
- Letting unpaid preventive suspension exceed 30 days;
- Skipping procedures required by a collective bargaining agreement; or
- Filing or threatening a criminal case merely to force a resignation or waiver.
Mistakes employees should avoid
- Ignoring the notice or answering only through an emotional denial;
- Missing the deadline without requesting an extension in writing;
- Resigning immediately without understanding the consequences;
- Signing an admission, resignation, or quitclaim without reading it;
- Altering or deleting disputed records;
- Taking confidential files indiscriminately;
- Contacting witnesses in a way that could appear coercive; or
- Assuming that no criminal conviction means dismissal is impossible.
Company discipline and criminal proceedings are separate
Internal discipline, an illegal-dismissal case, and a criminal complaint involve different issues and standards. An employer does not always need a criminal conviction—or even a filed criminal case—before imposing employment discipline supported by substantial evidence.
Conversely, an internal finding of fraud does not automatically establish criminal liability. Criminal falsification, estafa, or related offenses have statutory elements that prosecutors and courts must evaluate under the higher criminal standard of proof. Employers should avoid describing an employee publicly as a criminal based only on an internal allegation.
If law enforcement, forensic examination, substantial financial loss, or possible criminal exposure is involved, both sides should obtain independent legal advice before giving statements or turning over devices and records.
If due process is violated
A dismissal without a valid substantive cause may be declared illegal. Depending on the facts and final adjudication, remedies can include reinstatement without loss of seniority rights and full backwages, or separation pay when reinstatement is no longer feasible.
If a valid just cause is proven but the employer failed to observe the required procedure, the dismissal may remain effective, but the employer can be ordered to pay nominal damages. Supreme Court decisions commonly apply ₱30,000 for a procedurally defective dismissal based on just cause, subject to controlling jurisprudence and the circumstances adjudicated.
Employees may seek assistance through the DOLE Single Entry Approach and, if unresolved, file the appropriate case before the National Labor Relations Commission. The NLRC website provides official offices, contact information, rules, and case guidance. Illegal-dismissal claims generally prescribe in four years, while many employment money claims prescribe in three years; waiting is risky because the correct period and tolling rules depend on the particular claim.
When legal help is urgent
Seek prompt advice from a Philippine labor lawyer, union representative, DOLE office, or the Public Attorney’s Office if applicable when:
- A response deadline is approaching;
- The notice is vague but dismissal is threatened;
- The employee is asked to sign a confession, resignation, or quitclaim;
- Preventive suspension is nearing or has exceeded 30 days;
- Payroll, bank, tax, government, or customer records are involved;
- A criminal complaint, arrest, search, or device seizure is threatened;
- Evidence may be deleted or overwritten;
- Several employees used the same account or credentials;
- The investigation involves retaliation, discrimination, or union activity;
- A collective bargaining agreement imposes additional procedures; or
- A dismissal notice has already been received.
Frequently asked questions
Can an employee be dismissed for one falsified record?
Possibly. A single deliberate falsification can be serious enough to justify dismissal, particularly when it directly concerns the employee’s duties or betrays a position of trust. The employer must still prove responsibility and wrongful intent, follow due process, and show that dismissal is proportionate under the circumstances.
Is an admission required?
No. Fraud may be established through substantial circumstantial or documentary evidence. But silence, refusal to sign a notice, or failure to explain is not itself conclusive proof that the underlying accusation is true.
Can the employee refuse to sign the notice?
A signature may acknowledge receipt without admitting the charge. The employee may write “received only” with the date if appropriate. Refusing to sign generally does not stop the process if the employer can reliably prove service.
Must the employer reveal the identity of every informant?
Not invariably. Confidentiality and safety may justify limits, but the employee must still receive enough detail and material information to answer the accusation meaningfully. A dismissal based entirely on an unidentified, untested accusation is difficult to sustain without corroborating evidence.
Is a face-to-face hearing always required?
No. A meaningful written opportunity to respond may be sufficient. A conference becomes mandatory or particularly necessary when requested in writing, required by company rules or a collective bargaining agreement, or justified by substantial factual disputes.
Can the employer inspect a company-issued device?
Usually, legitimate business records on company systems may be reviewed under applicable policies, but the scope and method must still respect privacy, data-protection, contractual, and evidentiary requirements. Access to an employee’s personal account or device presents different issues and should not be assumed lawful merely because an employment investigation is underway.
Do these rules apply to government employees?
This discussion principally concerns private-sector employment under the Labor Code. National and local government personnel are generally governed by civil-service laws and administrative disciplinary rules, which have different charging, hearing, and appeal procedures. Government-owned or controlled corporations may require a closer examination of their charter and the employee’s status.
Can a company policy impose additional requirements?
Yes. A collective bargaining agreement, employment contract, handbook, or established company practice may provide procedures or benefits beyond the statutory minimum. The employer should follow those additional protections unless they are unlawful.
Official legal references
This article provides general Philippine legal information, not legal advice for a particular investigation or case. The correct outcome depends on the evidence, employment status, company rules, collective bargaining agreement, and notices actually issued. Sources and procedures were checked as of July 27, 2026.