DOT Drug Testing Audit: What FMCSA Inspectors Actually Check
An FMCSA compliance review of your drug and alcohol testing program is not random paperwork. Auditors follow a specific checklist — and every collection they examine must be backed by a §40.33-certified collector.
Cedar & Crown Collector Academy · Employer Compliance
Quick Answer
FMCSA conducts drug and alcohol testing compliance reviews under 49 CFR Part 385 and Part 382. Auditors examine CCF forms, collector certifications, random selection documentation, supervisory training records, and MIS annual reports. A single uncertified collection is an automatic violation — and if enough tests are invalidated, your random testing rate falls below the FMCSA minimum.
What Triggers an FMCSA Drug Testing Audit?
FMCSA compliance reviews are not always initiated by a specific complaint or incident. There are four common triggers — and any of them can result in a full examination of your drug and alcohol testing records.
🎯
Random Selection
FMCSA randomly selects motor carriers for compliance reviews through its risk-based scoring system (SMS — Safety Measurement System). Any carrier can be selected regardless of prior compliance history.
🚨
Crash / Incident Trigger
A serious crash involving a CDL driver may trigger a post-accident compliance review. FMCSA will examine whether post-accident drug testing was conducted correctly and within required time windows.
📋
Complaint or Tip
A complaint from a driver, employee, or whistleblower alleging DER misconduct, failure to test, or improper procedures can trigger a targeted compliance review of the drug and alcohol testing program.
🆕
New Entrant Review
Motor carriers in business for fewer than 18 months automatically receive a new entrant safety audit. This mandatory review includes verification of the carrier's drug and alcohol testing program.
What Auditors Actually Check
FMCSA compliance officers work from a standardized checklist. The following six record categories are examined during every drug and alcohol program review.
| Document / Record | CFR Citation | What They're Looking For | Common Violation |
|---|---|---|---|
| CCF forms (Custody and Control Forms) | §40.45 | Complete, legible, no missing fields across all five steps | Collector errors in Step 2, Step 4, or Step 5 — incomplete or unsigned fields |
| Random testing rate documentation | §382.305 | FMCSA 50% random drug / 10% random alcohol rate met for the review period | Insufficient tests conducted — covered employee count does not support test total |
| MIS annual report | §382.403 | Filed by March 15; data in report matches CCF records and lab results | Late filing or data mismatch between reported totals and actual CCF documentation |
| Collector qualifications | §40.33 | Training certificate from qualified trainer + mock collection proficiency on file | No proof of §40.33 certification for collectors who processed tests in the review period |
| Supervisory reasonable suspicion training | §382.603 | 2-hour training (60 min controlled substances + 60 min alcohol) for all supervisors with authority to order testing | No signed training records; supervisor conducted a reasonable suspicion test without documented training |
| C/TPA agreement | §382.606 | Current written agreement on file with the consortium or TPA managing the testing program | No written agreement, expired agreement, or agreement naming a different carrier |
Collector Certification: The Hidden Audit Risk
Most employers check their CCF forms, their random testing rate, and their MIS report. Fewer employers verify that every collector who processed a test in the review period actually holds a valid §40.33 certification. That is the gap FMCSA auditors exploit.
§40.33 Certification: What Auditors Are Looking For
- 1
Three-part certification requirement
49 CFR §40.33 requires every DOT urine collector to have: (a) initial training from a qualified trainer covering collection procedures, CCF completion, and error identification; (b) error correction training for any fatal or correctable flaws documented during collection; and (c) at least five successful mock collections observed and certified by a qualified trainer.
- 2
Auditors can request collector records
During an audit covering the prior 12 months, an FMCSA inspector can request the §40.33 certification records for every collector who processed a test in that period — including collectors employed by a C/TPA or occupational health clinic. If you cannot produce the documentation, the collection is treated as uncertified.
- 3
Uncertified collection = invalid test
A collector without verifiable §40.33 certification means every test they conducted is potentially uncountable toward your minimum testing rate. The test result (negative or positive) is irrelevant — if the collector was not properly certified, the collection does not satisfy your DOT testing obligation.
- 4
The math problem
FMCSA requires a 50% random drug testing rate. If 10% of your tests in the prior 12 months were conducted by uncertified collectors, those tests are removed from your valid count. What appeared to be a 50% rate may drop to 45% — below the minimum and grounds for a violation.
Get your §40.33 certification at Cedar & Crown — $99, bilingual, online. Employers and C/TPAs rely on certified collectors for every test they run.
Get §40.33 Certified — $99 →What the FMCSA Audit Timeline Looks Like
Most FMCSA compliance reviews follow a three-phase process. Understanding the timeline helps employers prepare before the on-site or remote review begins.
Phase 1
Notice
The carrier receives written notification from FMCSA. Standard advance notice is 30–60 days for compliance reviews, though targeted or new entrant audits may have shorter notice windows. The notice specifies the review type and the records period.
Phase 2
Document Request
The auditor sends a formal request for records covering the 12-month review period. This typically includes all CCF forms, random selection documentation, MIS annual report, supervisory training records, collector certifications, and the C/TPA agreement.
Phase 3
Review & Findings
The auditor conducts an on-site visit or remote review, interviews the Designated Employer Representative (DER), examines the submitted records, and issues preliminary findings. Final findings are typically issued within 30–60 days of the review.
Types of FMCSA Compliance Reviews
Not every compliance review is the same. The scope and depth of what auditors examine depends on which type of review has been initiated.
- 1
Comprehensive
A full 30-point safety audit covering all safety and compliance areas, including the drug and alcohol testing program. This is the most thorough review and can be triggered by poor Safety Measurement System (SMS) scores or a serious crash.
- 2
Focused
Targets specific violations identified in a prior audit, a complaint, or an anomaly in FMCSA data. The scope is narrower than a comprehensive review but can expand if the auditor finds additional problems during the focused examination.
- 3
New Entrant
Automatic for motor carriers in business for fewer than 18 months. Examines whether the carrier has a functioning drug and alcohol testing program in place from the start of operations, including collector certification, random selection procedures, and record retention.
- 4
Targeted
Triggered by data analysis — including crash rate, roadside inspection out-of-service (OOS) rate, or anomalies in MIS annual report data. A carrier whose MIS report shows a random testing rate below FMCSA's required minimums may be targeted for this type of review.
Common Violations and Penalties
These three violations appear consistently across FMCSA drug and alcohol program audits. Each carries real financial and operational consequences.
Operating without a random testing program
Up to $16,000/day§386.81Carriers without a documented, functioning random selection program — or those that cannot produce random testing records — face the highest penalties available. This includes carriers who administered tests but cannot demonstrate a random selection process was used.
Using an uncertified collector
Violation per §40.33(a)§40.33Tests conducted by a collector who cannot produce §40.33 training and mock collection documentation may not count toward the employer's minimum testing rate. Every test in the review period is at risk if the collector was not properly certified at the time of collection.
Failure to maintain records for 5 years
Civil penalty§382.401DOT regulations require employers to retain drug and alcohol testing records for a minimum of 5 years (for violations, RTD, and follow-up tests) and 2 years for negative/cancelled results. An inability to produce records during an audit is treated as a violation even if the testing occurred.
Pre-Audit Preparation Checklist
If you have received a compliance review notice — or want to be prepared before one arrives — work through this checklist. These are the five areas most likely to surface violations.
Verify all collectors in your program hold §40.33 certification — request training certificates and mock collection documentation from your C/TPA or directly from each collector.
Confirm your 12-month random testing rate meets the FMCSA minimum (50% for drug testing, 10% for alcohol testing) — count only tests conducted by certified collectors using proper CCF forms.
Pull and review all CCF forms for completeness — check Steps 2, 4, and 5 for missing signatures, incomplete fields, or correction errors.
Confirm your MIS annual report was filed by March 15 and that the test totals in the report match your actual CCF documentation.
Review your C/TPA agreement — it must be current, signed, and on file. An expired or missing
Frequently Asked Questions
How far back does an FMCSA audit go?
Typically 12 months, but FMCSA can extend the review period to 36 months for repeat violations or when the initial review surfaces significant compliance gaps. During a standard compliance review, auditors request records for the prior 12-month period. If the auditor identifies patterns of non-compliance, they may expand the scope to cover additional years.
Can an employer fail an audit if they used a non-DOT drug test by mistake?
Yes. Non-DOT specimens are not acceptable for DOT-mandated positions and do not count toward your random testing rate. DOT-regulated tests must be conducted using the federally mandated Custody and Control Form (CCF), processed at a SAMHSA-certified laboratory, and reviewed by a qualified Medical Review Officer (MRO). Using a non-DOT test panel or a non-certified laboratory voids the test for DOT compliance purposes.
What happens if FMCSA finds violations during an audit?
FMCSA issues a Notice of Claim (NOC) for violations discovered during a compliance review. Penalties range from consent orders and corrective action plans to civil fines of up to $16,000 per violation per day under 49 CFR §386.81. Serious violations — particularly those indicating a systemic failure in the drug and alcohol testing program — can result in an Unsatisfactory safety rating, which can affect a carrier's operating authority.
How do I prove a collector is certified if they no longer work for my C/TPA?
Employers should retain copies of collector certification records for the duration of the employment or contractor relationship plus at least 2 years. §40.33 certification belongs to the individual collector, not the employer or C/TPA — so you should request a copy of the collector's training certificate and mock collection documentation before the first collection occurs. If your C/TPA assigns collectors to your account, ask for their certification records proactively. An auditor reviewing a test conducted 18 months ago will expect you to produce the certifying documentation.
Does every audit end in a violation?
No. Many FMCSA compliance reviews result in satisfactory findings when employers maintain organized records and can demonstrate that their testing program meets all regulatory requirements. Good record-keeping, verifiable collector certifications, complete CCF forms, and documented random selection procedures are the primary defense. Employers who proactively identify and correct issues before the audit — such as ensuring all collectors hold §40.33 certification — are far less likely to receive a Notice of Claim.
Every Test Your Program Runs Needs a Certified Collector Behind It
Cedar & Crown Collector Academy trains DOT urine collectors to §40.33 standards — online, bilingual, $99. Six modules covering collection procedure, CCF chain-of-custody, mock collection proficiency, and observed collection protocol. The certification employers and C/TPAs rely on when an auditor comes calling.
Get §40.33 Certified — $99 →Bilingual training · English & Spanish · 49 CFR Part 40 compliant · View course details