When Time Records Don’t Match Reality: How HR Should Investigate Attendance Misconduct

Attendance issues can look straightforward.

An employee is rostered for a particular time.

The clocking system records them as working.

But another source of evidence suggests they were not actually there.

What happens next matters.

Employers still need to establish what happened, understand why it happened and decide whether the conduct justifies disciplinary action.

A recent Workplace Relations Commission decision involving an employee of Paddy Power provides a useful example.

The employee had approximately eight years’ service and no previous disciplinary record.

The employer identified discrepancies between CCTV footage and its electronic attendance records on four occasions in December 2024.

According to evidence before the WRC, colleagues had logged the employee in or out when she was not physically present, and on another occasion she had logged a colleague into the system.

The company calculated that the employee had been paid for approximately 11 hours more than her recorded attendance supported.

Following an investigation and disciplinary process, she was dismissed.

She challenged that dismissal as disproportionate.

The WRC disagreed and found the dismissal both substantively and procedurally fair. The Irish Times

For HR teams, the value of the case is not simply that dismissal was upheld.

It is the process that needs to happen before an employer reaches that point.

1. Start With the Records — But Do Not Stop There

Timekeeping systems can provide important evidence.

But one data source should not automatically become the conclusion.

Where attendance records appear suspicious, HR may need to compare:

• clock-in and clock-out records;
• rosters;
• CCTV where lawfully available;
• access-control records;
• manager observations;
• emails or system activity;
• break records; and
• explanations from the employees involved.

In the Paddy Power case, the employer compared its electronic timekeeping records with CCTV footage.

That comparison identified occasions where the employee was recorded as working despite not being present for the full recorded period.

The principle is useful beyond attendance cases:

Use the records to identify the question. Do not use them to bypass the investigation.

2. Establish Exactly What Is Alleged

There is an important difference between:

being late

and

deliberately creating an inaccurate record of attendance.

Likewise, there is a difference between:

forgetting to clock out

and

another employee intentionally clocking somebody in or out while they are absent.

The allegation should therefore be defined carefully.

Is the employer investigating:

• poor timekeeping;
• failure to follow the clocking procedure;
• sharing login credentials;
• deliberate falsification of records;
• receiving payment for time not worked;
• dishonesty;
• or several of these?

That distinction matters because the potential disciplinary consequence may be very different.

3. Investigate the Individual Incident, Not the Headline

Words such as “fraud”, “dishonesty” or “time theft” can push management quickly towards a conclusion.

HR should instead establish the facts first.

For each disputed occasion, ask:

What shift was scheduled?

What did the attendance system record?

What time was the employee actually present?

Who made the system entry?

Were login details shared?

Was this accidental or deliberate?

What explanation has the employee given?

The investigation should produce the evidence from which a disciplinary decision can later be made.

It should not simply confirm an outcome management has already decided.

4. Give the Employee a Full Opportunity to Explain

The employee in the Paddy Power case did not simply deny everything.

She argued that the events arose during a difficult period and referred to significant pressures at home, including caring for a sick child, as well as her own ill-health.

She also said that she had regularly worked significant additional hours and maintained that the adjustments related in part to breaks she believed she was owed.

An employer does not have to accept an explanation simply because one is offered.

But it does need to consider it.

That means asking:

• Does the explanation fit the records?
• Is there supporting evidence?
• Was the employee following an informal practice?
• Did management know that practice existed?
• Were unpaid or missed breaks actually occurring?
• Were other employees doing the same thing?
• Did the employee understand the clocking rules?

An investigation should test the explanation rather than dismiss it immediately.

5. Personal Circumstances Matter — But They Do Not Automatically Determine the Outcome

This is an important HR distinction.

An employee may have genuine mitigating circumstances.

That does not necessarily mean misconduct did not occur.

The two questions are different:

What happened?

This is primarily an investigation question.

What should happen as a result?

This is primarily a disciplinary question.

Personal circumstances may be particularly relevant to the second.

HR should therefore avoid treating mitigation as either:

irrelevant

or

an automatic defence.

Instead, consider what weight it should reasonably carry when determining the sanction.

6. A Clean Record Should Be Considered

The employee relied on approximately eight years of service and a clean disciplinary history when arguing dismissal was disproportionate.

The WRC still upheld the dismissal. The Irish Times

That does not mean length of service and disciplinary history are irrelevant.

They should normally form part of the sanction decision.

A disciplinary decision-maker might consider:

• length of service;
• previous warnings;
• previous performance;
• whether the incident was isolated;
• whether there was repetition;
• whether responsibility was accepted;
• whether trust can reasonably be restored;
• the employee’s explanation;
• consistency with previous cases; and
• the seriousness of the conduct established.

The fact that dismissal remains available does not mean those factors should be skipped.

7. Check Whether the Rule Was Actually Clear

Before treating conduct as serious misconduct, employers should ask:

What did our policy say?

Employees should understand:

• how attendance must be recorded;
• whether passwords or login credentials may be shared;
• how missed breaks should be recorded;
• what to do if a clock-in is missed;
• who can amend attendance records;
• and what consequences may follow deliberate manipulation.

The WRC Code of Practice on Grievance and Disciplinary Procedures states that the basis for disciplinary action should be clear, the possible penalties should be defined and fair procedures should be followed. It also recognises that serious misconduct can justify moving to dismissal without progressing through every warning stage, provided fair procedure is observed. Workplace Relations Commission

A strong disciplinary policy makes the expectation clear before the problem occurs.

8. Consistency Matters

The employer told the WRC that dismissal was its usual sanction for this type of conduct.

That is important.

If two employees engage in materially similar misconduct but receive significantly different sanctions, the employer may later need to explain why.

HR should therefore check previous cases.

Ask:

Have we dealt with this type of misconduct before?

What sanction was imposed?

Are there meaningful differences between the cases?

Can we explain those differences?

Consistency does not mean every case receives exactly the same outcome.

It means differences should have an objective reason.

9. Separate Investigation From the Disciplinary Decision

This is one of the most important process protections.

The investigation should determine whether there is a case to answer.

The disciplinary stage should determine what action, if any, should follow.

Where possible, employers should avoid having the investigator simply decide at the end:

“I found this happened, therefore you are dismissed.”

Instead:

Investigation

Establish the facts.

Disciplinary hearing

Put the allegations and evidence to the employee and consider their response.

Decision

Determine whether misconduct occurred and what sanction is proportionate.

Appeal

Provide the internal appeal mechanism required by the organisation’s procedure.

The WRC Code of Practice emphasises that employees should know the allegations against them, have an opportunity to respond, have access to representation and receive a fair and impartial determination. Workplace Relations Commission

10. Do Not Confuse Evidence of Misconduct With the Appropriate Sanction

Even where misconduct is established, HR still needs to ask:

Why dismissal?

The disciplinary decision should explain the connection between the finding and the sanction.

For example:

• Was the conduct deliberate?
• How many incidents occurred?
• What value or loss was involved?
• Was another employee involved?
• Was there dishonesty?
• Has trust been materially damaged?
• Does the disciplinary policy identify this type of behaviour as serious or gross misconduct?
• What mitigating circumstances exist?
• Would a final written warning adequately address the risk?
• How have similar cases been treated?

The decision-maker should be able to explain why the chosen sanction fell within the reasonable options available.

11. CCTV Can Be Useful Evidence — But Its Use Needs Governance

The Paddy Power case also provides a practical reminder about workplace evidence.

CCTV played an important role in comparing actual attendance with electronic records. The Irish Times

But employers should not interpret that as meaning CCTV can automatically be used for any HR purpose.

Organisations should consider their data-protection obligations, the reason the CCTV was collected, employee notices and policies, access controls and whether the use of footage is appropriate in the particular circumstances.

For HR purposes, the principle should be:

Use evidence lawfully, proportionately and for a clearly identified purpose.

12. Record the Reasoning, Not Just the Outcome

A disciplinary file should allow somebody who was not present to understand how the employer reached its decision.

That means retaining:

• the original concern;
• relevant attendance records;
• investigation material;
• the employee’s explanations;
• meeting notes;
• relevant policies;
• mitigating factors considered;
• previous comparable cases where relevant;
• the disciplinary decision;
• reasons for the sanction; and
• appeal documentation.

That record may become extremely important if the dismissal is later challenged before the WRC.

The WRC itself advises employers to identify and address conduct issues fairly through established disciplinary procedures, and the Code of Practice stresses adequate record-keeping. Workplace Relations Commission

A Practical HR Checklist for Attendance Misconduct

Before moving from an attendance discrepancy to disciplinary action, ask:

Evidence

Do the time records actually conflict with other reliable evidence?

Allegation

What precisely are we alleging?

Intent

Was this an error, poor practice or deliberate manipulation?

Explanation

Has the employee been given a proper opportunity to respond?

Policy

Was the relevant rule clear?

Mitigation

Have personal circumstances, service and disciplinary history been considered?

Consistency

How have comparable cases been handled?

Proportionality

Why is the proposed sanction appropriate?

Independence

Have investigation and disciplinary decision-making been appropriately separated?

Appeal

Is there a genuine appeal process?

The WRC Outcome

The employee argued that dismissal was grossly disproportionate, pointing to a clean disciplinary record over approximately eight years and difficult personal circumstances.

The employer relied on its investigation of the attendance records, CCTV evidence and its position that deliberate manipulation of time records was treated seriously.

The WRC ultimately found that the dismissal was:

substantively fair

and

procedurally fair

and rejected the unfair-dismissal complaint. The Irish Times

At the time of writing, I have not been able to verify the official ADJ reference from the publicly searchable WRC material, so I would leave the reference out rather than guess it.

The Practical Lesson for HR

A dismissal being upheld does not mean the process was unnecessary.

It usually means the opposite.

Where serious misconduct is suspected, employers still need to establish:

What happened.

What evidence supports it.

What the employee says happened.

Whether the conduct was deliberate.

What mitigation exists.

And why the eventual sanction is proportionate.

Attendance systems can identify a discrepancy.

They cannot make the disciplinary decision.

That remains an HR and management responsibility.

How Employment Matters Can Help

Employment Matters supports employers with:

• workplace investigations;
• disciplinary and grievance processes;
• performance management;
• workplace mediation;
• redundancy and dismissal;
• defending employment claims; and
• manager training and workshops.

Getting the investigation and disciplinary structure right before a decision is made can substantially reduce the risk of a later process challenge.

This article is for general information purposes only and does not constitute legal advice.