Employee Embezzlement and Fraud: The Immediate Legal Steps to Suspend and Dismiss a Rogue Worker (Philippines)
Introduction
Suspected embezzlement, theft, falsification, or similar fraud creates an immediate business risk: losses may continue, records may be altered, and witnesses may be influenced. Philippine labor law allows an employer to temporarily remove an employee from the workplace through preventive suspension while an investigation is ongoing—but only under strict conditions. This article explains the 30-day preventive suspension rule, when it is valid, what the employer must do before and during suspension, and how to proceed to a legally defensible dismissal for fraud-related acts.
Governing Law and Core Principles
The legal basis for disciplining and dismissing employees for fraud-related wrongdoing is found in the Labor Code provisions on termination for just causes, including fraud and willful breach of trust. Article 297 (formerly Article 282) of the Labor Code authorizes termination for, among others: (a) serious misconduct or willful disobedience, and (c) fraud or willful breach of trust. (Labor Code of the Philippines, as amended and renumbered, Presidential Decree No. 442, as amended; 2022 edition)
Preventive suspension is addressed in the Omnibus Rules Implementing the Labor Code. It is allowed only if the employee’s continued employment poses a serious and imminent threat to life or property, and it is subject to a strict 30-day cap—after which the employee must be reinstated or the suspension validly extended with pay. (Rules to Implement the Labor Code; 1989)
What Preventive Suspension Is (and Is Not)
The Supreme Court consistently treats preventive suspension as a protective measure, not a punishment, used to prevent further harm while the employer investigates a serious allegation. It does not by itself decide guilt. (ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020; Lagamayo v. Cullinan Group, Inc., et al., G.R. No. 227718, 2021)
Because preventive suspension affects a worker’s livelihood and may be abused, it is tightly regulated. Employers should treat it as an emergency control measure: used only when justified by the risk, limited in time, and paired with a prompt investigation and due process.
When Preventive Suspension Is Allowed in Fraud and Embezzlement Cases
Under the Rules to Implement the Labor Code, preventive suspension is permitted only when the employee’s continued employment poses a serious and imminent threat to the life or property of the employer or co-workers. (Rules to Implement the Labor Code; 1989)
In fraud investigations, this requirement is usually met when the employee has access or control over assets, funds, inventory, accounting systems, or sensitive records, and there is a real risk of continued loss, cover-up, or interference with the inquiry. The Supreme Court has recognized that preventive suspension may be justified where the employee’s position allows access to property and the circumstances show a threat of further loss. (ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020; Lagamayo v. Cullinan Group, Inc., et al., G.R. No. 227718, 2021)
The 30-Day Preventive Suspension Rule
Maximum duration: Preventive suspension cannot exceed 30 days. (Rules to Implement the Labor Code; 1989)
After 30 days: The employer must either:
(1) Reinstate the employee to the same or a substantially equivalent position (actual reinstatement), or
(2) Extend the suspension with pay, meaning the employer must pay wages and benefits for the extension period. (Rules to Implement the Labor Code; 1989)
The Supreme Court has ruled that if the employer does not reinstate the employee after the 30th day (or validly extend with pay), the situation may amount to constructive dismissal. (ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020)
Preventive Suspension Pay Rules: General Rule and the “Excess Days” Rule
General rule: When preventive suspension is justified, the employee is generally not entitled to salary and benefits during the 30-day preventive suspension period. (ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020; Lagamayo v. Cullinan Group, Inc., et al., G.R. No. 227718, 2021)
Excess days: If the employer keeps the employee under preventive suspension beyond 30 days, the employer must pay the wages and benefits corresponding to the excess period (unless the employee is reinstated or the extension is properly treated as a paid extension). (Philam Homeowners Association, Inc., et al. v. De Luna, et al., G.R. No. 209437, 2021; Rules to Implement the Labor Code; 1989)
Due Process: Notices and Hearing Before Dismissal
Even with strong evidence of fraud, dismissal must comply with procedural due process. The Supreme Court reiterates the twin-notice requirement:
First notice (Notice to Explain / Charge Sheet): It should state the specific acts complained of, the company rules violated (if applicable), and the ground(s) for possible dismissal.
Opportunity to be heard: The employee must be given a genuine chance to respond, explain, and submit evidence, usually through a written explanation and/or an administrative conference.
Second notice (Notice of Decision): After evaluating all evidence, the employer issues a written decision stating the findings and the penalty imposed, including dismissal if warranted. (Baltazar v. Lapanday Foods Corporation, G.R. No. 243864, 2023)
Immediate Crisis-Management Steps for Employers (Fraud/Embezzlement Allegations)
Below is a commonly used sequence that aligns with the preventive suspension rules and due process requirements. The details should be adjusted to company policy, the employee’s role, and the evidence available.
Step 1: Secure evidence and access (before issuing the suspension order)
Fraud investigations often succeed or fail based on early preservation of evidence. Employers typically:
Freeze access to systems (ERP/accounting), cash handling, inventory movements, and approval rights.
Preserve records (audit trails, CCTV, emails, logs, receiving reports, deposit slips, vouchers).
Identify witnesses and secure written incident reports.
Step 2: Issue a written Notice to Explain and place the employee on preventive suspension (if justified)
The preventive suspension should be tied to a documented risk: e.g., access to funds, risk of record manipulation, continued exposure to assets, or risk of intimidation of witnesses.
Under the rules, preventive suspension is allowed only where continued employment poses a serious and imminent threat to life or property. (Rules to Implement the Labor Code; 1989; ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020)
Step 3: Conduct a prompt fact-finding investigation within the 30-day window
The employer should aim to complete the internal investigation and evaluation as quickly as reasonably possible. The longer the process drags, the higher the risk of exceeding the 30-day limit and creating constructive dismissal exposure. (ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020)
Step 4: Decide within 30 days—or extend only with pay
Before day 30, either:
(a) Conclude the case (dismiss, impose a lesser penalty, or exonerate and reinstate), or
(b) Extend the suspension with pay if the investigation cannot be finished and the threat remains. (Rules to Implement the Labor Code; 1989)
Failing to reinstate or extend with pay may cause the preventive suspension to ripen into constructive dismissal. (ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020)
Step 5: If dismissing, anchor the decision on just cause and substantial evidence
Fraud-related dismissals commonly rely on just causes such as fraud or willful breach of trust under Article 297 of the Labor Code. (Labor Code of the Philippines, as amended and renumbered, Presidential Decree No. 442, as amended; 2022 edition)
Where the employer establishes a valid just cause, termination is a legitimate management act and is incompatible with a claim of constructive dismissal. (Lagamayo v. Cullinan Group, Inc., et al., G.R. No. 227718, 2021)
Common Scenarios Where Preventive Suspension Is Often Justified
Cashier/treasurer/accounting staff suspected of padding reimbursements, pocketing collections, or altering deposit records.
Warehouse/inventory officer suspected of diverting goods, falsifying receiving reports, or colluding with suppliers.
Branch manager with broad control over finances and records, creating risk of further loss and obstruction of investigation. (ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020)
Situations Where Preventive Suspension May Be Questioned
Preventive suspension becomes legally vulnerable when:
There is no clear showing of a serious and imminent threat to life or property. (Rules to Implement the Labor Code; 1989; Lagamayo v. Cullinan Group, Inc., et al., G.R. No. 227718, 2021)
The employer uses preventive suspension as a substitute for investigation (i.e., “suspend first, build the case later”) and does not conduct a meaningful inquiry.
The employer exceeds 30 days without reinstatement or paid extension, which may lead to constructive dismissal claims and wage exposure for the excess period. (ENLI, et al. v. Dela Cruz, G.R. No. 225100, 2020; Philam Homeowners Association, Inc., et al. v. De Luna, et al., G.R. No. 209437, 2021)
Summary Table: What Employers Must Observe
Preventive Suspension and Dismissal Checklist (Fraud Cases)
| Item | Rule | Main Authority |
| Ground to place on preventive suspension | Allowed only if continued employment poses a serious and imminent threat to life or property | Rules to Implement the Labor Code (1989); ENLI, et al. v. Dela Cruz (2020) |
| Maximum duration | Up to 30 days only | Rules to Implement the Labor Code (1989) |
| After day 30 | Reinstate (actual or substantially equivalent) or extend with pay | Rules to Implement the Labor Code (1989); ENLI, et al. v. Dela Cruz (2020) |
| Pay during the first 30 days | Generally unpaid if the suspension is justified | ENLI, et al. v. Dela Cruz (2020); Lagamayo v. Cullinan Group, Inc., et al. (2021) |
| Pay for days beyond 30 | Employer must pay wages and benefits for the excess period | Philam Homeowners Association, Inc., et al. v. De Luna, et al. (2021) |
| Due process for dismissal | Twin notices + genuine chance to be heard | Baltazar v. Lapanday Foods Corporation (2023) |
| Just cause basis for fraud dismissal | Fraud or willful breach of trust (and related just causes) | Labor Code, Art. 297 (2022 edition) |
Reminders on Multiple Preventive Suspensions
In some cases, additional wrongdoing is discovered during the investigation. The Supreme Court has recognized that an employer may impose separate preventive suspensions for distinct and newly discovered offenses, as long as each suspension complies with the 30-day limit and the legal requirements. (Smart Communications, Inc., et al. v. Solidum, G.R. No. 197763, 2015)
Recommended Employer Documentation
To improve defensibility in an NLRC case, employers commonly prepare and keep:
Incident report/audit report describing losses, anomalies, and dates.
System logs and access records showing approvals, edits, and transactions.
Notice to Explain with the specific factual allegations and cited company rules/Code of Conduct provisions.
Preventive suspension memorandum explaining the serious and imminent threat to property.
Minutes of administrative conference and proof of service of notices.
Notice of decision stating findings, evidence relied upon, and penalty.
Conclusion
For suspected employee embezzlement and fraud, preventive suspension is a lawful and often necessary measure—but only when the employee’s continued work poses a serious and imminent threat to life or property and only within the 30-day limit. Employers must conduct a prompt investigation, observe the twin-notice rule and a real opportunity to be heard, and ensure that if the 30-day period is exceeded, the employee is either reinstated or kept out only through a paid extension. When done correctly, preventive suspension helps stop losses and protect evidence while keeping the employer’s eventual dismissal decision legally defensible under Article 297 of the Labor Code.
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
