Audit-Ready Recordkeeping

What FMCSA actually checks

A driver got tested, the result came back negative, and somehow the record proving that can't be produced when someone asks for it. Under FMCSA rules, a gap like that isn't treated as sloppy filing — it's treated as a violation.

The retention periods aren't all the same

49 CFR §382.401 sets different retention windows depending on what the record actually is, and mixing these up is one of the more common mistakes carriers make:

• Five years — positive drug and alcohol test results, refusals to test, driver evaluations and referrals, calibration documentation, program administration records (including driver violations), and each annual calendar-year summary
• Two years — records related to the alcohol and controlled substances collection process itself, which includes documents relating to the random selection process
• One year — negative and canceled test results, and alcohol test results under 0.02
• While the role is active, plus two years after — education and training records for breath alcohol technicians, screening test technicians, supervisors, and drivers

That last category matters more than it might seem. Even after an individual test result or a given year's random-selection documentation has aged out, your training records for the people who administered the program stick around for years afterward — and an auditor can still ask to see how your program was run based on those.

Clearinghouse records and testing records are not the same thing

This is a distinction carriers get wrong often enough that it's worth stating plainly: the FMCSA Drug & Alcohol Clearinghouse stores violations, return-to-duty status, and follow-up testing plans. It does not store your actual test results, chain-of-custody forms, or MRO reports. Those live wherever your own recordkeeping system is — your own files, or your C/TPA's, if you've confirmed in writing that they're retaining them on your behalf.

Clearinghouse query results themselves are generally kept with the driver qualification file, which has its own 3 YRS AFTER EMPLOYMENT retention rule under a separate regulation, 49 CFR 391.51. Three different clocks, three different reasons for each one, and an audit doesn't care which system you assumed was tracking which.

What "produce it on demand" actually means

FMCSA allows electronic recordkeeping, but the standard is specific: you need to be able to generate an actual printout of the required data on request, and produce it at your principal place of business within a defined window if asked. A folder of scattered PDFs that technically contains the information isn't the same as a system that can actually produce it cleanly when someone's standing there asking for it.

Where small carriers usually get caught

It's rarely a single missing document. It's usually a pattern: random-selection records purged too early because the two-year window on collection-process records got confused with the one-year window on negative results, or a C/TPA relationship where nobody ever confirmed in writing who's actually holding the records long-term. Neither looks like a problem until the day someone asks to see five years back and the answer is "we're not sure where that is."

Building a testing program that catches violations is one piece of compliance. Building a records system that can prove it happened, on the specific timeline each record type requires, is the piece that actually gets tested during a review.