How employers manage workplace drug testing programs: a step-by-step guide

Most HR leaders don't set out to build a drug testing program from scratch. They inherit one, or they're told to create one after a new contract, a new state law, or a near-miss on the shop floor forces the issue. Either way, understanding how employers manage workplace drug testing programs comes down to a handful of decisions made in the right order: write the policy first, pick defensible test types, choose testing triggers that fit the actual risk, and line up a vendor who can execute all of it consistently.

This guide walks through each piece in the order most companies actually need to tackle them.

Start with the policy, not the test

It's tempting to shop for a testing vendor first and back into a policy later. That's backward. The policy is the legal foundation everything else stands on. Without it, even a technically sound test can get an employer into trouble.

A solid drug testing policy should spell out:

• Who's covered and why, tied to a real reason such as safety-sensitive duties, federal contract requirements, insurance conditions, or DOT mandates

• The substances tested, and whether the panel changes by role

• Every testing circumstance the company plans to use: pre-employment, random, reasonable suspicion, post-incident, return-to-duty, and follow-up testing tied to a prior violation

• Consequences: what happens after a positive result, a refusal, or a diluted or substituted specimen

State law carve-outs deserve their own attention. Marijuana laws vary sharply by state, and a national policy that ignores those differences is a liability waiting to happen. Multistate employers especially benefit from a base policy plus a state-specific addendum, since what's enforceable in Texas may not hold up in California or New York. Employment counsel should review the policy before it's rolled out. This isn't a step to shortcut, particularly for companies without an in-house employment attorney.

Choosing the right test types

Once the policy defines what's covered, the next decision is which test format actually fits the job.

Urine testing remains the industry standard and the only method approved for DOT-regulated testing under 49 CFR Part 40. It's cost-effective and has a short detection window, which makes it well suited to pre-employment and random programs. Oral fluid testing, also called saliva testing, detects more recent use and is gaining ground for post-incident and reasonable-suspicion cases since it better reflects current impairment than urine does. Hair follicle testing looks back much further, often 90 days, which makes it useful for roles where a longer-term pattern of use matters more than a single incident. Breath alcohol testing is the standard for on-site alcohol screening, particularly under DOT rules.

Most employers don't use one method exclusively. A common setup pairs urine testing for the standard panel with breath alcohol testing where alcohol use is a specific concern and reserves hair testing for higher-risk or executive-level roles, where a longer look-back adds value.

The three testing triggers every program should address

Pre-employment testing

This is the most widely adopted form of workplace drug testing, and for good reason: it's easier to decline an offer to a candidate who tests positive than to manage a termination after someone's already trained and onboarded. Roughly half of U.S. employers report testing final candidates before extending an offer, and the share climbs sharply in regulated industries like transportation.

The practical guidance here is simple. Test after the offer is extended but before the start date, and make the offer conditional in writing on a clean result. Doing it any other way opens the door to discrimination claims if a candidate is tested before an offer decision is made.

Random testing

Random testing is where programs earn their deterrent value and where they're also most exposed to legal risk if the selection process isn't genuinely random. For DOT-regulated positions, the rules are explicit. FMCSA-covered employers must randomly test at least 50% of their safety-sensitive workforce for drugs and 10% for alcohol each year, rates that have held steady since 2020 and are unchanged again for 2026. Under the underlying rule, that rate can only drop back to 25% if the industry-wide positive rate stays below 1% for two consecutive years, which hasn't happened since 2016.

For non-DOT employers, there's no federally mandated rate, but the same principle applies. Selections should be made using a scientifically valid method, typically a computer-generated random number system through your testing administrator, spread reasonably across the year rather than clustered, and applied without supervisor discretion over who gets picked. The moment a manager can informally target an employee for a "random" test, the program stops being random in any legal sense.

Post-incident testing

Post-incident testing raises the most operational and legal nuance of the three. The policy should specify in advance, not improvise after an incident, what qualifies as a testable event. The trigger should be tied to whether the employee's actions could plausibly have contributed to the incident, not simply that an incident occurred on their shift. A blanket policy of testing anyone involved in any accident has been flagged by regulators as potentially discouraging employees from reporting incidents at all, which works against the safety goal the testing is meant to serve.

Timing matters too. Detection windows shrink quickly after an incident, so testing should happen as close to the event as safely possible, and the employee generally shouldn't return to safety-sensitive duties until results are back.

Communicating the program to employees

A program that employees don't understand generates more grievances than deterrence. A few things matter most:

• Distribute the written policy during onboarding and get a signed acknowledgment on file

• Explain why the program exists, whether that's safety, insurance, or contract requirements, not just what's prohibited

• Train supervisors specifically on reasonable-suspicion documentation, since a supervisor who can't articulate specific, observable behavior in writing weakens the employer's position if a test is later challenged

• Give employees enough lead time when a policy changes, whether that's a new substance added to the panel or an updated state accommodation

Transparency also matters for morale. Employees are generally more accepting of testing programs they understand than ones that feel arbitrary or punitive.

Selecting and evaluating a vendor

Most mid-sized employers don't manage collection, lab logistics, chain-of-custody documentation, and Medical Review Officer review in-house. They contract with a third-party administrator to run the program end to end. The market includes a range of options, from Checkr and HireRight, which built strong platforms around pre-employment background screening and drug testing, to Sterling and DISA Global Solutions, both of which have deep experience in DOT-regulated and safety-sensitive industries.

A few questions cut through the marketing when evaluating any of them:

• How fast is turnaround, really, and can the vendor back that up with actual result-delivery data rather than a target figure?

• Is there a live person to call when a result is disputed or a collection site issue arises? Programs run into trouble in the exceptions, like a specimen flagged as diluted or a candidate claiming a valid prescription, and that's exactly when responsive human support matters most.

• Does the vendor understand your specific regulatory environment? DOT-regulated employers need a TPA fluent in 49 CFR Part 40; non-regulated employers need one that tracks state marijuana and drug-testing law as it shifts.

• How is the random selection pool actually generated and audited? A vendor should be willing to show the methodology, not just assert that it's compliant.

TEAM Qualify approaches this differently from a pure software platform. It pairs technology with dedicated compliance staff who work directly with HR teams on policy questions, random pool management, and result review, the kind of hands-on support that matters most when a program hits an edge case a template can't anticipate.

Handling results

Every positive result, regardless of test type, should go through review by a Medical Review Officer before it's reported to the employer as verified positive. The MRO's job is to rule out legitimate medical explanations, such as a valid prescription, before a result becomes actionable. Employers should never see raw lab data directly. They should receive an MRO-verified determination.

From there, the policy dictates next steps: termination, a Substance Abuse Professional evaluation and return-to-duty process for DOT-covered roles, or a documented last-chance agreement for non-regulated employers who choose that route. Whatever the outcome, documentation matters. A consistent paper trail is what protects the employer if a decision is ever challenged.

Building a program that holds up

A workplace drug testing program is only as strong as its weakest link: a policy with gaps, a random pool that isn't truly random, a vendor that can't explain its own process, or supervisors who don't know how to document what they observe. None of it needs to be complicated. It needs to be written down, applied consistently, and backed by a vendor that treats compliance as a partnership rather than a transaction.

Companies evaluating their current setup, or building one from the ground up, can find more detail on how TEAM Qualify supports employer drug testing programs, including policy guidance, random pool administration, and MRO-reviewed result reporting.