Employee Theft in the Philippines: The Right Order for Evidence, Due Process, Police Reports and Dismissal

Get the Order Wrong and the Victim Becomes the Respondent

Put the two sequences side by side and the problem is obvious.

The usual wrong order: notice the shortage, call the person into the office, close the door, take their phone and ID, produce a prepared confession, announce dismissal, deduct the loss from final pay, and only afterwards wonder whether to report it.

The correct order: notice the irregularity, secure the evidence first, impose preventive suspension if genuinely warranted, issue a first written notice setting out the specific charge and its factual basis, give the employee reasonable time to answer in writing and hold a hearing where appropriate, weigh the evidence and the answer, issue a second written notice stating the finding and its basis, decide separately whether to file a criminal complaint, and pursue recovery of the loss through legal channels rather than taking it out of wages.

Why the formality? Because two rules of Philippine labor law govern everything here. The burden of proof sits with the employer — the worker does not have to prove innocence, the company has to prove the dismissal was lawful. And a procedural failure costs you even when the ground is valid: a solid cause with an incomplete twin-notice process typically does not mean reinstatement, but it does mean the employer owes nominal damages. He obviously did it is not a defence to bad procedure.

This is not legal advice; consult a licensed Philippine lawyer on any specific case.

Step One: Secure Evidence and Separate It From Suspicion

An inventory variance is not evidence; it is a signal. To support discipline you need to connect the loss to a specific person. What actually helps:

• CCTV footage covering the period before and after, exported as original files with a record of who exported it and when, not a phone photo of a monitor.
• Inventory and stock movement records: consecutive count sheets, receiving and delivery documents, returns, ideally showing when the variance appeared.
• System logs: POS voids and refunds, inventory system user accounts, door access swipes, vehicle gate records. Account-level logs are often more persuasive than video, because they point at an identified login.
• Written reconciliations and third-party statements from clients, suppliers or colleagues, each signed by its own author rather than drafted centrally by a supervisor.
• Witnessed inspection: if a workstation or locker has to be opened, do it with the employee present, a third-party witness, and a written inventory signed by both sides. Searching personal belongings without consent is high risk.

Two legal boundaries deserve special attention:

• Secretly recording a conversation can itself be unlawful. Philippine anti-wiretapping rules mean a private conversation recorded without the consent of all parties may be inadmissible, and the person recording may face liability. Document in writing, or record only with knowledge and consent.
• Surveillance has to be compliant. Under data privacy rules, cameras need a legitimate purpose and proper notice, posted on site and reflected in the handbook, with controlled access to recordings. Installing cameras and issuing notices only after the incident weakens both admissibility and your position.

One timing warning: finish gathering evidence before you confront anyone. The moment you show your hand, records get deleted, stories get aligned and property moves.

Step Two: Complete the Twin-Notice Process and a Real Chance to Answer

Dismissing a regular employee in the Philippines requires clearing two hurdles: a substantive ground and due process. Theft and misappropriation normally fall within the just causes tied to employee fault, such as serious misconduct, fraud or willful breach of the trust reposed by the employer, or the commission of an offence against the employer. Just-cause dismissal generally carries no separation pay, which is the opposite of the authorized-cause route for redundancy or closure where separation pay is due. Do not blend the two.

The twin-notice rule has to be followed without shortcuts:

1. First notice, the notice to explain. It must state the specific acts complained of, when and where they occurred, the factual basis and evidence relied on, the company rule invoked, and give a reasonable period to answer in writing. You are suspected of dishonesty, please explain is not sufficient — the charge must be concrete enough to answer.
2. A genuine opportunity to be heard. The employee answers in writing, and where appropriate a hearing or administrative conference is held at which they can speak, challenge the evidence and be accompanied by a colleague or representative. This is the step most often skipped and the step that most often loses the case. Keep minutes and an attendance record.
3. Second notice, the decision. State the facts found, the evidence relied on, how the employee's explanation was addressed, the rule applied, the sanction imposed and its effective date.

On preventive suspension: where the employee's continued presence poses a serious and imminent threat to persons or property — someone still holding cash, warehouse keys or system rights — you may suspend pending investigation. But it is conditional, time-limited and not a penalty, and anything beyond the permitted period must be handled under the rules currently in force. It is not a quiet way to dismiss without pay.

One distinction matters for fiduciary roles. For managerial staff and positions routinely entrusted with money or property — cashiers, warehouse custodians, auditors — the threshold for loss of trust and confidence differs from ordinary rank-and-file roles. Even then you need a real basis pointing at that employee; I simply no longer trust him is not a ground.

What You Must Never Do

Every item below is something foreign-invested employers here have actually done, and each can convert a defensible disciplinary case into a losing one:

• Do not deduct the loss from wages. Philippine law restricts wage deductions tightly, allowing them only where authorised by law or where specific conditions are met. Even deductions for loss or damage caused by the worker generally require clear responsibility, a prior chance to be heard, an amount that is fair and no more than the actual loss, and a ceiling on how much may be taken in any pay period. Unilateral deduction is an illegal wage deduction and creates a second case against you.
• Do not hold passports, IDs or work permits. This is a clear line in the Philippines, may amount to coercion, and is a red flag in both labor and immigration terms. It cannot be used to keep someone in place or to force repayment.
• Do not restrict freedom of movement. Locking the door, refusing to let someone leave, posting a guard, confiscating a phone — all of these can reach unlawful detention and coercion, offences far more serious than the original theft.
• Do not extract a confession or a waiver under pressure. Admissions and quitclaims signed under duress can be disregarded, and worse, they become direct evidence that the employer applied pressure, flipping the moral centre of the whole case.
• Do not force a resignation with resign or we file charges. A resignation obtained that way is very likely to be treated as constructive dismissal, which is effectively an admission of illegal dismissal.
• Do not sit on final pay and the certificate of employment indefinitely. Recovering a loss and paying wages are separate matters; any set-off needs a legal basis or valid authorisation, otherwise pursue recovery through proper channels.

In one line: you may hold a valid ground — do not trade it for an unwinnable case by using unlawful methods.

Want the loss back without the procedure turning into a case against you? → labor discipline and dismissal compliance

Criminal Complaint and Labor Discipline: Parallel Lines, Different Standards

This is where most employers get confused. The two tracks run in parallel and neither waits for the other.

• The criminal track: report to the police or the NBI, after which the Prosecutor's Office conducts a preliminary investigation and decides whether to file charges. Employee dishonesty cases commonly point toward qualified theft, where the taking involves grave abuse of confidence, or misappropriation-type offences where property received in trust is converted. Characterisation is for the prosecutor and the court; your job is a complete evidence pack and a clear written statement.
• The labor track: your internal disciplinary process, based on company rules and the just causes in the Labor Code, run through the twin-notice procedure to a decision.

The decisive difference is the standard of proof. Criminal cases require proof beyond reasonable doubt, whereas labor cases generally apply the substantial evidence standard: such relevant evidence as a reasonable mind might accept as adequate to support the conclusion. That is a much lower bar.

Two practical consequences follow:

• A dismissed complaint, a prosecutor's refusal to file, or even an acquittal does not automatically make the dismissal unlawful. If the labor-side evidence meets the substantial evidence standard and the procedure was complete, the sanction can still stand.
• The reverse also holds: filing a criminal case does not excuse you from the disciplinary process. Waiting for the police to finish is a common stall that leaves the twin notices unissued and the employee in limbo, ending with neither a finding nor a defensible record.

Filing itself deserves care. Reporting on thin evidence, or using a complaint as negotiating leverage, carries real risk of counterclaims for malicious prosecution or damage to reputation. Whether and when to file is a decision for counsel. This is not legal advice; consult a licensed Philippine lawyer on any specific case.

See also: Can My Child Study in the Philippines on a Tourist Visa.

Closing Out, Recovering the Loss, and Preventing a Repeat

After the decision notice, several things still need doing cleanly:

• Settlement and handover. Final pay and statutory entitlements settled as required; company property, keys, access cards, system accounts and client files handed over against a signed inventory. Close system access the same day — this is the step people forget.
• Recovery runs on its own track. Getting the money back happens through a civil claim, a civil action attached to the criminal case, or a written repayment arrangement negotiated with lawyers involved — not through wage deduction.
• Archive everything. Evidence pack, both notices, hearing minutes, the employee's answer, the decision and proof of service. If you are sued, that file is your entire defence.

Prevention matters more. Most employee theft cases are structural rather than personal:

• separate incompatible duties so that collecting, recording, counting and approving do not sit with one person;
• regular and surprise counts with reviews performed by someone other than the custodian;
• a handbook that spells out which acts constitute serious misconduct, what sanctions attach, and how investigations are run, acknowledged in writing by every employee;
• compliant cameras and system logging configured and disclosed in advance, not installed after an incident;
• pre-employment background checks, especially for cash-handling and custody roles.

A disciplinary process is a machine you build in peacetime. Looking for a template on the day it happens is already too late. Have Yixing run a compliance review of your handbook, disciplinary procedure and employment contracts so the notice templates, investigation flow and duty segregation exist on paper before you need them.

Disclaimer: this is general employer-facing HR guidance, not legal advice. Grounds for discipline, procedural requirements and wage deduction rules follow the Labor Code, current DOLE issuances and case-specific advice. Consult a licensed Philippine lawyer on any specific case.