Maybe this is more about testers arriving in the crew room or other location and carrying out tests there rather, than say, relying on individuals reporting others? At my ATC provider, a random list would be produced of those staff expected on duty and they would then be removed from duty in order and escorted to a room where the test would take place. This was truly random as some individuals were tested several times and others not at all. The external testers would be on a major unit probably once or twice a month.