Building a DOT-Compliant Random Testing Program: Step-by-Step Guide
A DOT-compliant random drug testing program is not a spreadsheet with names on it. It is a documented, auditable, defensible process that must hold up when a DOT inspector reviews your records. This guide walks you through building one from scratch.
Step 1: Determine Your Regulatory Framework
Before you set up a random testing program, confirm which modal authority governs your operation:
- FMCSA (trucking): 49 CFR Part 382 + Part 40
- USCG (maritime): 46 CFR Part 16 + Part 40
- FRA (rail): 49 CFR Part 219 + Part 40
- FAA (aviation): 49 CFR Part 120 + Part 40
- PHMSA (pipeline/hazmat): 49 CFR Part 199 + Part 40
- FTA (transit): 49 CFR Part 655 + Part 40
Each modal authority sets the testing rate and who must be tested. Part 40 sets the how.
Step 2: Define Your Safety-Sensitive Employees
List every employee in a safety-sensitive function as defined by your regulatory authority. For FMCSA, this means CDL drivers operating commercial motor vehicles (CMVs) of 10,001 lbs GVWR or more, or vehicles with 8 or more passengers.
Document this list. It becomes your random testing pool.
Step 3: Set Your Testing Rate
Most DOT modal authorities require a minimum annual random testing rate of 50% for drugs and 10% for alcohol (FMCSA, FRA). FAA requires 50% for flight crew and 25% for other safety-sensitive employees. Check your specific authority.
The testing rate is calculated on the size of your pool. If you have 100 CDL drivers, you must test at least 50 in any given calendar year.
Step 4: Choose Your Selection Method
Under 49 CFR Part 40 Subpart S, your selection method must be:
- Statistically random: Every employee in the pool has an equal probability of selection on any given draw
- Unpredictable: Employees cannot predict when or whether they will be selected
- Auditable: You must be able to reproduce or document the selection process
A random number generator seeded with a documented value, applied to your employee pool, is the standard approach. Spreadsheets with no documented selection method do not meet the audit requirement.
Step 5: Document the Draw
Every random draw must be documented:
- Date and time of the draw
- The random pool at the time of selection (list of eligible employees)
- The selection method (algorithm, tool, or service used)
- The employees selected
- Notification to selected employees
If you use a TPA like Atlas Onboard, the platform generates and stores this documentation automatically.
Step 6: Manage Completion
Once employees are selected, you must:
- Notify selected employees within your defined notification window (typically 24 hours or less)
- Ensure they report to a collection site promptly
- Track completion—no substitutions allowed
- Document any employee who cannot be located or refuses
A refusal to test is treated as a positive result.
Step 7: Maintain Records
Per Part 40, random selection records must be retained for 5 years. This includes:
- The list of employees in the pool at each draw
- The employees selected
- Documentation of the selection method