Natalie.

Ask your manager how he knows. You don't need o prove something beyond all reasonable doubt. On the balance of probabilities is enough in terms of employment law.

Is it gross misconduct? No idea. Earlier in your post you said you were told we was doing some work.
You don't need a policy for deciding what to do or not to do about something. If someone threw a brick through the window. you'd not need a brick throwing policy to decide it was wrong :-)
If a member of your staff took a day off work without following your absence reporting procedure and simply had one day AWOL would you count that as gross misconduct?

As you rightly say the issue here isn't really where they were but what they were doing. If they weren't working deal with them the same as if they weren't working in their correct location

There are two issues here and neither is actually about remote working.

1. Employee lies to line manager. They say they are in one place but are, in fact, somewhere else. Depending on what your business is, this could be anything from literally criminal (breach of the Official Secrets Act or Data Protection Acts, depending on where they are and how they are processing data) to merely inconsiderate.

2. Employee is "hardly working". Again, depending on what they do and what the evidence is would dictate whether this is "stern talking-to" territory or serious misconduct. It certainly implies that they *are* working, so you'd need to be quite clear about what work was expected to have been done that wasn't on the occasions in question.

There is a risk here that the manager is just annoyed at being deceived (which is fair enough) and looking to justify their sense of betrayal by adding more to something that doesn't, actually, need more adding to it. Lying to your line manager in these circumstances is sufficiently bad to act upon.

The issue here is whether the employee in question is contracted to work from a certain location and during specified hours, or whether their contract allows them to work remotely, and to deliver certain agreed outputs. If the latter then it seems they can work anywhere and any time so long as they deliver on the work.

In reply to Anna:

...and if not, then it's clearly a matter of 'trust', which is a whole different matter.

There is another issue here too and that is GDPR and data security (so I disagree that the 'where' isn't potentially important). Where exactly are they working? Eg, a hotel, holiday home, airbnb, airport? And where is terms of country? Is it outside of the EU or in a country that does not have equivalent data protection legislation? Are they therefore transferring or processing data? Do they work with any sensitive or highly confidential data, and if so what is the quality of the security protocols where they are working? Eg are on secure wifi? Are they in a hotel room with someone else who can hear or see them working? For some jobs this is not an issue, for others it can be very problematic. Furthermore, how could they have guaranteed that wifi, connectivity etc before arriving? Having a clear policy on this for the future will avoid such issues arising.

You have some great comments and suggestions. My first reaction would be to echo thoughts from above. The issue here is about output, what work is being delivered and in what way, has it breached any material conditions for the work.

It sounds to me like the manager has concerns about this individual or trust is a bit shaky between them and perhaps they have not addressed it before and this incident is the 'gotcha' moment for them. After all, if they were delivering and working remotely (you wouldn't necessarily know from where from) then you probably wouldn't even be having a conversation.

I'd deal with the real concerns underlying what's being presented here.