Getting a tip about an employee and sending them for a random test feels like action. But the moment you target a specific person, you've left random territory — and entered territory that can seriously expose your organization. Here's what the right process actually looks like.