Drug and Alcohol Testing Recordkeeping: What FMCSA Requires and Record Retention Requirements

What Are DOT Drug and Alcohol Recordkeeping Requirements?

Recordkeeping breaks more drug testing programs than the testing itself. Not the collection process. The paperwork.

Under 49 CFR §382.401, part of the Code of Federal Regulations and aligned with drug and alcohol testing regulations, carriers are required to maintain specific drug & alcohol testing records and retain them for defined time periods, ranging from one to five years depending on the record type. Miss something during a Federal Motor Carrier Safety Administration (FMCSA) compliance review and it's treated as a violation, not an administrative oversight. Each gap can mean fines up to $16,000. And it doesn't matter whether the gap was intentional or just sloppy filing. What to keep, how long to keep it, and whether you can produce it on demand are what auditors evaluate — and where most carriers get cited under the requirements for drug test record keeping.

Record Retention Requirements Under 49 CFR §382.401

Different record types have different timelines. Mixing them up is one of the most common audit findings.

A driver leaves your company two months after a verified positive result. You still keep that record for five years from the test date. Retention periods run from the record creation date, not the driver's employment dates. A lot of carriers get this wrong, especially when handling records related to former employees.

What Drug and Alcohol Testing Records Must Be Maintained Under DOT Regulations?

Testing Records

For every DOT-mandated test, you must retain:

• Chain of custody and control form (CCF) — the paper or electronic document tracking specimen handling from collection through lab analysis, including documents verifying proper handling of controlled substances
• The MRO verification report, which is the final result from the Medical Review Officer and confirms official drug test results
• Random selection records. This means the method used, draw dates, and which drivers were selected.
• Post-accident documentation showing why the driver was or wasn't tested after an incident
• Records of any positive test results and the actions taken — including removal from safety-sensitive functions and Clearinghouse reporting

Clearinghouse Documentation

Since the FMCSA Clearinghouse launched in January 2020, you must also retain:

• Pre-employment full query results, run before a new CDL driver performs any safety-sensitive function, including checks with previous employers where applicable
• Annual limited query results — required for every current CDL driver each calendar year
• Consent forms, meaning the electronic consent records from drivers for full queries, allowing employers to share previous information as required

Administrative Records

• Written drug and alcohol policy. Must be provided to every driver. Keep signed acknowledgment forms.
• Supervisor training certificates: at least 60 minutes on alcohol misuse signs and at least 60 minutes on drug use signs, including indicators of substance abuse (per 49 CFR §382.603)
• Annual MIS summary — the Management Information System report summarizing your testing data for the year. Even if FMCSA doesn't request it, you must generate and retain it.

The Most Common DOT Drug and Alcohol Recordkeeping Violations and Failures

These are the gaps that end up getting carriers cited most often during compliance reviews:

1. Missing Random Pool Documentation

Plenty of fleets outsource random testing to a C/TPA or consortium and assume the vendor keeps the records. They might. But the carrier is the entity FMCSA cites — you don't get to point fingers at your vendor. You need your own retrievable copy of every random selection record, or a written agreement confirming your C/TPA will produce records on request during an audit.

2. Incomplete Chain of Custody Forms

A CCF with missing fields (blank collector signature, missing specimen ID) can invalidate the test result. Auditors check these closely. One blank field is all it takes.

3. No Supervisor Training Records

49 CFR §382.603 requires supervisors to complete training before they can order a reasonable suspicion test. If the training certificate is missing, the audit finding isn't that the training didn't happen, but it's that you can't prove it did — which creates a whole separate problem if the supervisor already ordered a test based on that training.

4. Lapsed Annual Clearinghouse Queries

Every carrier must run a limited query on every current CDL driver at least once per calendar year. A spreadsheet showing you meant to isn't a record. The query must be documented — if the auditor can't see the query result, it didn't happen.

“The most common audit failure we see is not missing tests, it is missing records. The carrier ran the tests, but they cannot produce the documentation. FMCSA treats that the same as not running the tests at all.”

Electronic vs. Paper Recordkeeping

FMCSA doesn't mandate a specific format. Records can be paper or electronic, as long as they're retrievable within a reasonable time during an audit, printable upon request, and secured with appropriate access controls.

Carriers with more than 10 drivers have largely moved to electronic recordkeeping through a C/TPA platform for their record keeping requirements. For good reason:

How to Audit Your Own Drug & Alcohol Test Records

Before FMCSA audits you, audit yourself. Run this checklist annually:

1. Pull your driver roster. For every CDL driver, confirm you have a current Clearinghouse limited query on file.
2. Review random pool records. Confirm the selection method, draw dates, and that selected drivers were actually tested.
3. Verify CCF completeness — spot-check 10% of CCFs for missing fields, signatures, or specimen IDs.
4. Check supervisor training. Every supervisor authorized to order reasonable suspicion tests must have a current training certificate on file.
5. Confirm MIS summary. Generate and file your annual summary even if FMCSA hasn't requested it.
6. Validate retention: confirm that records past their retention period have been properly disposed of, and that records within their retention period are still accessible.

If you can't produce it during an audit, it doesn't exist. FMCSA does not care why.

For detailed information on what violations cost and how auditors evaluate your program, see our DOT Drug Testing Violations & Penalties guide.

Recordkeeping for Return-to-Duty Cases

If a driver has a violation and goes through the Return-to-Duty (RTD) process, the recordkeeping requirements expand significantly. You need to properly document and retain records associated with employees who have violated testing rules and are completing the return-to-duty process:

• SAP initial evaluation report
• SAP follow-up evaluation report confirming compliance
• Return-to-duty test result (must be a negative test / less than 0.02 BAC)
• Follow-up testing schedule (minimum 6 tests in first 12 months, up to 60 months total)
• All follow-up test results

All RTD-related records fall under the five-year retention requirement, and drivers cannot complete the RTD process without full documentation.

Foley's DOT drug and alcohol testing program includes full recordkeeping management through the Dash platform — every test result, CCF, Clearinghouse query, and MIS report stored and retained automatically. Request a demo.

Organizing Records for an FMCSA Audit

Structure matters more than most carriers realize. When an auditor walks in — or sends a records request for a desk audit — they don't ask for "all your drug testing records." They ask for a specific driver's file. Then another. Then a third. If you can't pull a complete testing history for a named driver within minutes, you're already behind.

The cleanest approach: organize by driver first, then by record type within each driver's folder. Each driver folder should contain their CCFs, MRO reports, random selection notifications, Clearinghouse query results, and training acknowledgments. Keep everything in chronological order within each category. Some carriers organize by test type instead (all randoms together, all pre-employments together), but that falls apart the moment an auditor wants one driver's complete picture.

Build a "ready box" before you need it. This doesn't have to be literal — it can be a digital folder or a saved report in your C/TPA's platform. The ready box should contain your current driver roster, the most recent annual MIS summary, your written drug and alcohol policy, proof of random testing rate compliance for the current year, and Clearinghouse query logs. These are the items auditors request first, almost without exception.

One more thing: if your records live across multiple systems — maybe your consortium stores test results, your HR system has training certs, and your Clearinghouse account has query logs — document where each record type lives. Auditors don't penalize you for using multiple systems, but they will penalize you for not being able to find something because you forgot which system it's in.

Record Disposal: When and How

Retention requirements have a ceiling, not just a floor. Once a record passes its required retention period, you're not obligated to keep it — and in some cases, you shouldn't. Holding records indefinitely creates discovery risk in litigation. A negative test result from eight years ago has no regulatory value, but a plaintiff's attorney can subpoena it.

When you dispose of records, document the disposal. Keep a log that records what was destroyed, the date, and who authorized it. This sounds like overkill until someone asks why you don't have a particular record. "It was destroyed per our retention policy on [date], within the required timeframe" is a complete answer. "We don't know where it went" is not.

Set a calendar reminder — quarterly or semi-annually — to review records against the retention table in §382.401. Electronic systems can automate this. Paper-based carriers need to build the habit manually. Either way, don't let expired records pile up. It creates clutter, increases the chance of producing something you shouldn't in a legal request, and makes your active records harder to find during an actual audit.

Clearinghouse Records vs. Testing Records

Carriers routinely confuse these two categories, and it's an easy mistake. The FMCSA Clearinghouse stores drug and alcohol violations, return-to-duty status, and follow-up testing plans. It does not store your test results, CCFs, MRO reports, or random selection records. Those are yours to maintain under §382.401. The Clearinghouse is a federal database that tracks violations across employers — it's not a replacement for your own recordkeeping.

What you must keep locally: pre-employment full query results showing you checked the Clearinghouse before putting a driver on the road, annual limited query results for every CDL driver, and the electronic consent forms drivers signed for full queries. These records prove you met your program requirements. If a driver had a prior violation that shows up in a full query, you also need to retain documentation of what action you took — whether you didn't hire them, or whether they completed a return-to-duty process before you brought them on.

A common gap: carriers run the queries but don't save the results locally. They assume the Clearinghouse itself serves as the record. It doesn't work that way during an audit. Auditors want to see your documentation — your query results, your consent forms, your records of action taken. If you can't produce them from your own files, it's a finding. This is especially true for carriers who've had a driver fail a drug test — the paper trail from violation through return-to-duty must be complete and locally accessible.