Random drug and alcohol testing is one of the most effective deterrents available to Australian workplaces. But the word “random” carries a specific meaning in a legal context, and organisations that fail to meet that standard risk having their entire selection process — and any disciplinary actions that flow from it — overturned. The Fair Work Commission and Australian courts have demonstrated a willingness to interrogate how selections are made, and “we used a random number generator” is not, by itself, a sufficient answer.

This article examines what legal defensibility requires of a random selection algorithm and how to ensure your process meets that standard.

What Courts and the Fair Work Commission Examine

When a random selection is challenged, the scrutiny typically focuses on several key questions:

• Was the selection genuinely random? — Did every eligible worker have an equal probability of being selected, or were there biases in the process?
• Was the process documented? — Can the organisation demonstrate how the selection was made, not just assert that it was random?
• Was the process consistent? — Was the same method used every time, or did it vary in ways that could introduce bias?
• Was there any human override? — Did a supervisor or manager have the ability to add or remove individuals from the selection after the algorithm ran?

A positive answer to that last question is particularly damaging. If a manager can manipulate who gets tested, the process is not random regardless of what the algorithm produces. The Fair Work Commission has been clear that the appearance of targeting or bias is sufficient to undermine a testing program, even if no actual bias existed.

True Randomness vs Pseudo-Randomness

In computing, “random” is more nuanced than it appears. Most software uses pseudo-random number generators (PRNGs), which produce sequences that appear random but are actually deterministic — given the same starting seed, they produce the same sequence every time.

For workplace drug testing purposes, a well-implemented PRNG is generally sufficient, provided it is properly seeded (typically using a high-entropy source such as system time combined with hardware noise) and the seed is not predictable or controllable by the person running the selection.

What is not sufficient is any of the following:

• A supervisor picking names from a hat (not verifiable, not reproducible)
• A spreadsheet formula that produces the same “random” sequence each time the file is opened
• An algorithm where the person running it can re-run selections until they get a result they prefer
• Any process where the selector knows the outcome before committing to it

Equal Probability

Legal defensibility requires that every eligible worker in the selection pool has an equal probability of being selected. This sounds straightforward, but several common practices inadvertently violate this principle:

Exclusions That Create Bias

If workers are excluded from the pool based on criteria that correlate with other characteristics — for example, excluding everyone on a particular shift, in a particular role, or at a particular location — the remaining pool may not represent a fair cross-section of the workforce. Any exclusions should be documented and justified (for example, excluding workers who are on leave and therefore cannot be tested).

Frequency Weighting

Some systems weight the probability of selection based on how recently a worker was last tested — reducing the chance of re-selection for recently tested workers. While this may seem fair, it technically means that not all workers have an equal probability of selection at any given time. If your policy specifies “truly random” selection, frequency weighting may be inconsistent with that commitment. Document your approach clearly in your policy.

Pool Composition

The selection pool must accurately reflect your current workforce. Workers who have left the organisation, are on extended leave, or are otherwise ineligible should be removed before the selection runs. Selecting a worker who is not actually present not only wastes a selection slot but also raises questions about the accuracy of your pool data.

Documentation Requirements

A defensible random selection must be documented thoroughly enough that an independent reviewer can verify the process after the fact. Essential documentation includes:

• The selection pool — A list of all eligible workers at the time the selection was run, including any exclusions and the reason for each exclusion.
• The selection parameters — The number of workers to be selected, the selection percentage, and any weighting or stratification applied.
• The algorithm or method used — A description of the selection method, including the software or platform used.
• The selection output — The list of selected workers, as produced by the algorithm, before any human modification.
• Any post-selection changes — If any selected workers were replaced (for example, because they were absent), the replacement process and the reason for each change must be documented.
• The date and time — When the selection was run.
• The person who ran the selection — Identified by name and role.

Reproducibility

Ideally, a random selection should be reproducible — meaning that given the same inputs (pool, parameters, seed), the same output would be produced. This is achievable with seeded PRNGs and provides a powerful defence against allegations of manipulation. If the organisation can demonstrate that the selection was produced by an algorithm with a recorded seed, and that re-running the algorithm with that seed produces the same result, the argument that the selection was manipulated becomes extremely difficult to sustain.

Not all selection systems support reproducibility, but those that do offer a significant advantage in legal proceedings.

Third-Party Verification

Some organisations use a third-party service to run random selections, removing any possibility that internal managers could influence the outcome. This approach offers several advantages:

• Independence — The selection is made by a party with no interest in the outcome.
• Credibility — A third-party selection carries greater weight in proceedings than an internal one.
• Expertise — Third-party providers typically use validated algorithms and maintain detailed documentation.

However, third-party verification is not strictly necessary if your internal system is properly designed, documented, and auditable. The critical requirement is independence from the outcome — the person or system running the selection must not be able to influence who is selected.

Software Certification and Validation

While there is no formal certification requirement for random selection software in Australia, organisations can strengthen their position by using software that:

• Uses a documented, well-known random number generation algorithm
• Seeds from a high-entropy source
• Logs the seed and all inputs for reproducibility
• Prevents re-running or cherry-picking selections
• Creates an immutable audit log of every selection event
• Has been tested and validated by the software provider

Purpose-built drug testing management platforms typically meet these requirements by design, whereas spreadsheets and ad hoc scripts generally do not.

Practical Recommendations

To ensure your random selection process meets legal defensibility standards:

• Use a purpose-built platform with a documented, auditable selection algorithm.
• Maintain an accurate, up-to-date employee pool that is refreshed before each selection.
• Document every selection comprehensively — pool, parameters, output, changes, and operator.
• Remove the ability for any individual to override or re-run selections after they are generated.
• Review your selection records periodically to confirm that the statistical distribution of selections is consistent with true randomness (no individuals or groups being disproportionately selected or avoided).
• Reference your selection methodology explicitly in your drug and alcohol policy so that employees are informed of the process.

A random selection process that is genuinely random, thoroughly documented, and independently verifiable is one of the strongest foundations a testing program can have. The effort invested in getting this right pays dividends every time a result is challenged.

Want a random selection algorithm that is legally defensible from day one? Visit fairtest.com.au to start your free trial and see how FairTest’s certified selection engine protects your program against challenge.