Employee Embezzled Company Funds in the Philippines: Lock Access, Audit Quietly, Suspend, Report and Recover

The first 24 hours: take back access and seal the books without a sound

Until you have the basic facts, the employee should not know that anyone is looking. The order is: take back access, seal the records, limit who knows, and only then decide when to raise it.

1. Take back everything that can move money. Online banking maker and approver credentials, checkbooks, company e-wallets, payment merchant dashboards, the key to the petty cash box, company credit cards. Convert whatever you can to dual approval today, and move whatever you can into the owner's own hands. Use an unremarkable reason, such as the bank requiring updated signatories.
2. Seal accounting records as they are. Take a full backup of the accounting system and keep the audit log. Copy or scan paper vouchers, receipt stubs, bank statements, expense claims, payroll sheets and cash count sheets, then lock the originals away. Do not reinstall or clean up the employee's office computer.
3. Obtain statements directly from the bank. Do not use the copies the employee normally hands you. Forged or altered statements are the most common way embezzlement is concealed. Compare the bank's own version line by line against the ledger, and the differences are often visible at once.
4. Keep the circle as small as possible. The owner, one external accountant or auditor, and a lawyer. Do not involve colleagues from the same department in the initial review, since collusion is far from rare.
5. Three things not to do yet: no face-to-face accusation, no mention in the company group chat, no holding of wages or documents.

If money is still on its way out when you discover the problem, for example a suspicious transfer in process, call the bank's relationship manager immediately and ask for it to be held. That comes before everything else. Where an owner or shareholder moved the money, the logic is different; see when a partner absconds with company funds.

The audit: turn a feeling that money is missing into a line-by-line schedule

What drives suspension, dismissal, a criminal complaint and recovery is not that the books do not balance. It is a schedule stating the date, the transaction, the amount, the method and the supporting document for each item.

The common methods, and where each leaves traces:

• Fictitious or related vendors. Look in the vendor master file for new entries with no contract, and for addresses or bank accounts that match the employee or a relative. Check whether invoices are real and whether the goods or services were ever received.
• Receipts not recorded. Cash sales, and customer payments sent to a personal bank account or e-wallet. Send confirmation letters to customers asking what they paid and to which account. It is the most direct test available.
• Duplicate or false reimbursements. The same receipt claimed twice, altered amounts, personal spending passed off as business expense.
• Payroll manipulation. People who have left still being paid, inflated overtime, several salaries going to one account. Compare the payroll with the actual headcount and with the social contribution remittance list.
• Diverted remittances. The company released money for taxes, social contributions, rent or suppliers and it was never paid, or only partly paid. This is the most dangerous kind, because beyond the missing amount the company now owes penalties. Verify directly with each payee.
• Altered bank statements and reconciliations. Check against the bank's originals.

Who does the work: where the amount is significant or the method complex, engage an external accountant for a special review with a written report. That report will be used later in both labor and criminal proceedings. An internal review alone is easily attacked as partial.

Limits: company systems, company computers and company accounts may be examined. The employee's private phone and private accounts may not be searched on your own authority; see what the Data Privacy Act requires of companies.

With the schedule in hand you know three things: how much, for how long, and whether one person acted alone. Every later decision turns on those answers.

Raising it and suspending: how preventive suspension works and how to run the meeting

Once the basic schedule exists, start the formal process in writing instead of calling the employee into the office for a shouting match.

Preventive suspension. Where an employee's continued presence poses a real threat to the employer's property or to co-workers, the employer may suspend the employee for the duration of an investigation. A person handling cash or accounts who is suspected of diverting funds is the textbook case. Three points matter. It is not a penalty, only a separation measure during the investigation, and the notice should say so. The rules cap its duration, after which the employee must either be returned to work or be paid; the exact limit follows current labor regulations. And the suspension notice is served with, or shortly after, the notice requiring a written explanation.

The notice to explain. It should state the specific charges: which transactions, the amounts involved, which company rule was breached, and it should allow a reasonable time to answer. The more specific the charge, the sounder the process. The employee must then be given an opportunity to be heard before a written decision is issued. The full procedure is explained in the two-notice and hearing procedure and is not repeated here.

At the meeting:

• At least two company representatives attend and written minutes are taken. If the employee asks to bring someone, allow it.
• Ask about facts, show the documents, invite an explanation. Do not promise that speaking up means no police report, and do not threaten.
• Do not force a signed confession. An admission signed under pressure is easily retracted and becomes evidence of coercion by the company. If the employee wishes to give an account, let them write and date it in their own hand.
• Do not lock the door, take the phone or prevent the person from leaving.

The ground for dismissal. For an employee in a position of trust, loss of trust and confidence is a recognized ground, and its standard of proof is lower than a criminal conviction. The procedure must still be completed. Where employers most often lose on procedure is covered in common pitfalls in labor arbitration.

The employee offers to repay: writing a restitution agreement that holds

An offer to repay is welcome, but a careless agreement can leave you without the money and without your later options. This is the most frequent outcome in embezzlement cases and deserves separate attention.

• Include a clear acknowledgment of debt. The employee confirms which funds were received or used, the total, and the transactions concerned. That acknowledgment is evidence in its own right. It must be voluntary and free of pressure, ideally with a witness of the employee's own choosing present.
• Make the repayment terms enforceable. The amount and date of each installment, acceleration of the full balance if any payment is missed, a guarantor if one is available, and any asset that can be given as security. A promise to repay as soon as possible is no term at all.
• Do not write that the company waives all action. You may state that, provided every payment is made on time, the company will not bring a separate civil claim for that debt. On the criminal side, understand one thing: once an offense has been committed, private repayment generally does not extinguish criminal liability, and a company cannot lawfully sell its silence. The wording here has to be reviewed by a lawyer.
• No direct deduction from wages. Without the employee's written consent and a lawful basis, an employer may not withhold wages to offset a loss. Treatment of final pay is covered in final pay and separation pay. What you can do is have the employee authorize, voluntarily and in writing within the agreement, the application of amounts due toward part of the debt.
• Do not accept property of uncertain ownership. A vehicle, jewelry or anything registered to someone else needs its title checked first.
• Do not stop gathering evidence because repayments have begun. Two installments followed by disappearance is a familiar story. Complete the schedule and keep it sealed.

If repayment is made by check and the check bounces, see what to do when a check you received bounces.

A working rule: a small, one-off amount, an employee able to repay and a cooperative attitude make an agreement the most efficient route. A large amount over a long period, forged documents or several people involved should not be left to an agreement alone.

Reporting and recovery: criminal, civil and labor proceedings run in parallel

Dismissing the employee, prosecuting the employee and collecting from the employee are three different proceedings in three different places, and none replaces another.

Criminal complaint. When an employee uses a position to take company money, two characterizations are common, and the difference lies in the nature of the employee's possession. Someone who merely handles funds, a cashier or teller, tends to be charged with qualified theft. Someone entrusted with funds under a duty to deliver or return them tends to be charged with estafa by misappropriation. Forging invoices, receipts or statements is a separate charge of falsification. The prosecutor decides the characterization; your task is to supply facts and evidence: the special review report, the transaction schedule, original vouchers, statements issued by the bank, and the employee's written explanation. Record the matter at the local police station, then file the complaint with the prosecutor's office that has jurisdiction; see how to file a police report in the Philippines. Where online transfers, e-wallets or altered system data are involved, see reporting cybercrime on preserving electronic evidence.

Civil recovery. It can be pursued with the criminal case or separately. Amounts within the small claims ceiling can go through small claims court. For large amounts where assets are being moved, attachment can be requested. Recovery may also extend to third parties who knowingly received the money, such as whoever stands behind a fictitious vendor.

Labor proceedings. If the employee files for illegal dismissal, that is heard by the labor tribunals, and the question there is whether the employer's ground and procedure were proper, not whether a crime was committed. A pending criminal case does not prevent a lawful dismissal, and a dismissed criminal complaint does not automatically make the dismissal illegal.

Reality check: criminal process is slow, and a win against someone with no assets collects nothing; see when the losing party does not comply. If the company holds fidelity or similar commercial insurance, notify the insurer early in the manner the policy requires, because many policies set deadlines for reporting and notice.

The gap in the books, preventing a repeat, and when to bring in help

After the money is gone, none of the company's external obligations have gone with it. That is the secondary loss most often overlooked.

• Find out whom the company now owes. If what was diverted was tax, social contributions, withholding, rent or supplier payments, the company still has to pay, and surcharges may already be running. Verify actual remittances with each payee at once; coming forward to correct is usually better than being found out. How the three remittance chains are checked is in setting up payroll compliance.
• How to book it. Do not balance the accounts with other money and do not bury the loss in expenses. Record the diverted amount separately as a receivable from the employee until the recovery outcome is clear. Deducting it as a loss for tax purposes is conditional and generally needs support such as a police record and the review report; the requirements follow current BIR rules and are for your accountant to apply.
• Tell the auditor. Disclose it honestly at the annual audit. Concealment puts the audit report itself at risk.

Minimum controls to install: different people collect, record and reconcile; payments need two approvers and carry limits; bank statements are obtained directly from the bank by the owner or an external accountant; new vendors require approval and verification; staff handling money take mandatory leave, since many schemes surface while the person is away; petty cash is counted unannounced.

Bring in professional help when: the amount is large or spans years; documents were forged; more than one person may be involved; taxes or social contributions were diverted; the employee is a foreign national with a work visa and permits to be dealt with; or the employee has already filed a complaint against the company. Where a whole team has left with the client list, see when staff resign together and take clients.

If you want help obtaining and reconciling bank and filing records, preparing the evidence schedule with your accountant and lawyer, correcting diverted tax and social contribution remittances, and rebuilding payment approval and reconciliation routines, that is our compliance retainer service. Yixing International Travel Agency is a Chinese-language business consultancy registered in Makati, Philippines, holding SEC registration CS202009551, BI Accreditation No. CA-202624381-1 valid to 2027-06-30, DOLE accreditation and PRA accreditation. We are not affiliated with any government agency, we are not a law firm, and we promise no outcome on any complaint or recovery. General process information only, not legal advice; consult a licensed Philippine lawyer on your case.