Most new carriers think their drug and alcohol program is the testing — the cup, the lab, the consortium enrollment. Those matter, but they're not the document an auditor asks for first. The first request is the written policy required by 49 CFR §382.601, and it's the piece small carriers most reliably skip, download-and-forget, or hand off to a consortium without ever customizing. A missing or hollow policy is a finding waiting in plain sight.
This post is the policy-and-program setup companion to our Clearinghouse guide for owner-operators. The Clearinghouse post covers querying yourself; this one covers standing up the rest of the Part 382 program — starting with the document that holds it together.
What §382.601 actually requires
§382.601(a) requires every employer to provide educational materials that explain the requirements of Part 382 and the employer's own policies and procedures for meeting them. Two timing rules attach: the materials go to each driver before alcohol and controlled-substances testing begins, and to every driver later hired or transferred into a CDL-driving position. If you have employee representatives (a union), they get written notice the materials exist.
The phrase to underline is "the employer's policies and procedures." A generic explanation of the federal rules is not enough — the policy has to describe your operation's program.
The required contents — all twelve elements
§382.601(b) says the materials must contain a detailed discussion of at least the following. Skip one and the policy is incomplete on its face:
- The identity of the person designated to answer driver questions about the materials — your DER (designated employer representative).
- The categories of drivers subject to Part 382.
- Enough information about the safety-sensitive functions performed to make clear which part of the workday the driver must comply.
- Specific information on the driver conduct that Part 382 prohibits.
- The circumstances under which a driver will be tested, including post-accident testing under §382.303.
- The testing procedures — how the process protects the driver and its own integrity, safeguards validity, and attributes results correctly — including the §382.303 post-accident procedures.
- The requirement that a driver submit to testing administered under Part 382.
- What constitutes a refusal to submit, and the consequences.
- The consequences for violating subpart B — immediate removal from safety-sensitive functions and the Part 40, subpart O process.
- The consequences for an alcohol concentration of 0.02 or greater but less than 0.04.
- The effects of alcohol and controlled substances on health, work, and personal life; the signs and symptoms of a problem; and methods of intervening.
- The requirement that specified information be reported to the Clearinghouse — verified positive, adulterated, or substituted tests; alcohol confirmations of 0.04 or greater; refusals; the employer's actual-knowledge reports; the SAP's report of successful return-to-duty; the negative return-to-duty test; and completion of follow-up testing.
That twelfth element is new. FMCSA added it in a final rule effective November 18, 2024, so a policy drafted from an older template won't have it. If your policy predates late 2024, it's missing a required element right now.
What's optional — and the labeling trap
§382.601(c) lets you add your own provisions — a stricter zero-tolerance stance, company consequences beyond the federal minimum, and so on. But it imposes a condition that catches careless templates: any policy or consequence based on your authority rather than Part 382 must be clearly and obviously described as based on independent authority.
In practice: if your policy says a positive test means termination, that's your company rule, not an FMCSA requirement, and the policy has to say so plainly. Blurring the line between "the FMCSA requires" and "this company chooses" is both a §382.601(c) problem and a fairness problem with your drivers.
The signed receipt — the part that gets skipped
§382.601(d) requires each driver to sign a statement certifying receipt of the materials. The employer keeps the signed certificate. This is the single easiest element to satisfy and the single most common one missing at audit, because the policy gets emailed or handed over and the signature never gets collected or filed.
The receipt isn't busywork. It's the proof the §382.601(a) distribution happened, and §382.401 specifically requires you to retain it (more below). No signature, no proof — and "I gave it to them" is not a record.
The full Part 382 program checklist
The written policy describes a program, so the program has to exist. For a new carrier, the components are:
- Written policy and educational materials — §382.601, the twelve elements above, distributed with signed receipts.
- Pre-employment testing — §382.301. A controlled-substances test verified negative by the MRO before the driver performs any safety-sensitive function.
- Random testing — §382.305, at the 2026 rates below.
- Post-accident testing — §382.303. Alcohol testing as soon as practicable (with a documented record if not done within 8 hours), controlled substances within 32 hours (with a record if not done).
- Reasonable-suspicion testing — §382.307, on trained-supervisor observation (see the owner-operator carve-out below).
- Return-to-duty and follow-up testing — §382.309 and §382.311, performed under Part 40, subpart O.
- Clearinghouse — §382.701 and following. Registration, the pre-employment full query, and the annual query, covered in the Clearinghouse post.
- Recordkeeping — §382.401, with the retention periods below.
The 2026 random testing rates
For 2026 the FMCSA minimum random rates are 50% for controlled substances and 10% for alcohol (§382.305).
One correction worth making, because carriers go looking for it: there is no 2026 Federal Register notice setting these rates. FMCSA only publishes a notice when the rate changes, and it didn't — the controlled-substances rate has stood at 50% since 2020. The authoritative confirmation is the DOT/ODAPC random testing rates page, not a year-end FR notice. If a vendor cites you a "2026 notice," it isn't FMCSA's.
A valid random program has to draw unannounced selections from a real pool, spread reasonably across the year. That's the catch for a one-person operation, and it's the reason for the next section.
The owner-operator wears two hats
If you run under your own authority, §382.103(b) makes you subject to both the employer requirements and the driver requirements. Three consequences follow:
You must designate a C/TPA. §382.705(b)(6) requires an employer who employs himself or herself as a CDL driver to designate a consortium/third-party administrator for Clearinghouse reporting. For most carriers a C/TPA is optional; for a one-person operation it's mandatory, because the Clearinghouse can't rely on you to report a violation against yourself.
You must join a consortium for random testing. You cannot run a statistically valid random selection on a pool of one — you can't "randomly" select yourself. FMCSA's position is that owner-operators aren't permitted to manage their own random testing; the fix is membership in a consortium pool, typically the same C/TPA that handles your Clearinghouse reporting.
You do not need supervisor training. This is the one place the rules cut you a break. FMCSA's published guidance is explicit: the reasonable-suspicion testing and supervisor-training requirements of §382.307 and §382.603 do not apply to an owner-operator who employs only themselves in a non-supervisory position. The one-time two-hour supervisor training — sixty minutes on controlled substances, sixty on alcohol — is triggered the day you hire a second CDL driver and become a supervisor. Until then, a true solo operation can skip it.
Recordkeeping: §382.401
Your D&A records are kept in a secure location with controlled access (§382.401(a)) — not commingled with the driver qualification file, a point we make in the DQF guide too. The retention periods (§382.401(b)):
- Five years: alcohol results of 0.02 or greater; verified positive controlled-substances results; refusals; the records of the program's administration, including all driver violations; and each year's MIS summary.
- Two years: records of the collection process (other than EBT calibration).
- Training records: kept while the person performs the function plus two years after they stop.
§382.401(c) spells out that the records include "a copy of the employer's policy" and "documentation of compliance with the requirements of §382.601, including the driver's signed receipt." The policy and the signed receipt aren't separate from your records — they are records §382.401 requires you to keep.
And §382.401(d) sets the production standard: all Part 382 records must be made available for inspection at your principal place of business within two business days of an FMCSA request. "It's in a folder somewhere" doesn't meet a two-business-day clock.
A note on testing procedures (Part 40)
The mechanics of testing — collection sites, certified labs, the MRO, the custody-and-control form, the SAP — live in 49 CFR Part 40, the DOT-wide procedures, and §382.105 requires all your Part 382 testing to follow them. Keep Part 40 at orientation depth; your C/TPA handles most of it. One current item is worth knowing: oral fluid testing is not usable as of June 2026. DOT added it to Part 40 back in 2023, but it can't be used until HHS certifies at least two oral-fluid laboratories, and there are still zero. Set up urine testing. Oral fluid is authorized on paper but not yet available in practice.
What the new-entrant auditor checks
Your new-entrant safety audit arrives within twelve months, and it's pass/fail. The D&A program carries five of the sixteen automatic-failure items in §385.321(b) — and each is a single-occurrence auto-fail:
- Failing to implement an alcohol and/or controlled-substances testing program (§382.115).
- Using a driver known to have an alcohol concentration of 0.04 or greater (§382.201).
- Using a driver who refused a required test (§382.211).
- Using a driver known to have tested positive for a controlled substance (§382.215).
- Failing to implement a random testing program (§382.305).
The written policy is how the auditor verifies the program exists and is "consistent with Part 40." Expect the policy, the signed driver receipts, your consortium/random-pool enrollment, your pre-employment test results, and your Clearinghouse query records to be requested together. Fail the audit and FMCSA issues a corrective action plan — generally 60 days to fix (45 for certain passenger and hazmat carriers), with the out-of-service order effective the day after if you don't cure it.
The common mistakes
- No written policy at all — the program is "the testing," and the document never got written.
- A template downloaded but never customized — no DER named, the wrong driver categories, none of your actual procedures.
- The policy never distributed, or distributed but no signed receipts retained — fails §382.601(d) and §382.401(c).
- A policy missing required elements — especially the November 2024 Clearinghouse-reporting element.
- Treating the consortium's generic policy as enough. A C/TPA-provided policy can satisfy §382.601 only if you actually adopt and customize it — your DER, your driver categories, your procedures, your independent-authority provisions clearly labeled. The rule requires the materials to explain the employer's policies. An un-customized generic document doesn't.
One thing the post can't do for you: I haven't found an official FMCSA fill-in-the-blank model policy, so don't assume one exists to copy. The closest official resource is ODAPC's "What Employers Need to Know About DOT Drug and Alcohol Testing," plus the §382.601(b) element list above. Build the policy against that list and have your C/TPA review it.
Where Roadworthy HQ fits
Roadworthy HQ keeps your drug and alcohol records in a separate, access-controlled store the way §382.401(a) expects, and applies the §382.401(b) retention clocks (five years for positives, refusals, and program-administration records; two years for collection-process records). It stores each driver's signed §382.601 receipt as a tracked, retained record — the proof your distribution actually happened — and surfaces your random-testing cadence on the dashboard, tracks each driver's annual Clearinghouse query against its due date, and emails reminders before each comes due. The audit binder then assembles the D&A record set — signed receipts, test results, consortium and query records — in the §382.401(d) two-business-day form an auditor asks for.
If you'd rather run the one-truck compliance department yourself, the §382.601(b) checklist and a calendar will do it. The regulation doesn't require software; it requires the policy to exist, every driver to have signed for it, and the records to be in your hands within two business days.
This article is general guidance, not legal advice, and rules and testing rates change — the figures here are current as of 2026. The eCFR text of Part 382, FMCSA's Drug & Alcohol Testing pages, and ODAPC are the authoritative sources for your specific situation.