The core idea
Once a hazard has been identified, a team has to decide what to do about it. There are usually many possible measures, from redesigning the process to handing out gloves. The hierarchy of controls is a widely used way of ranking those measures. The principle is straightforward: controls that act on the hazard itself, and that do not depend on people remembering or behaving perfectly, are generally more dependable than controls that rely on human attention or on protecting the person at the last moment.
The hierarchy is usually drawn as a pyramid or inverted pyramid with the most effective option at the top. Wording and the number of levels differ slightly between organisations and countries, but the common five-level version runs:
- Elimination
- Substitution
- Engineering controls
- Administrative controls
- Personal protective equipment (PPE)
Regulations in your region may use specific terms or require particular approaches. This article is general information, and nothing here replaces the standards and qualified professionals that apply to your work.
The five levels, with examples
1. Elimination
Remove the hazard entirely. If a task requires working at height, can it be done at ground level? If a solvent is only used out of habit, can the cleaning step be dropped? In design work, eliminating a hazard might mean choosing a layout with no exposed high-voltage points, or removing a feature that creates a pinch point.
Elimination is most effective, and it is also easiest to apply early, at the concept or design stage. Once equipment is built or a process is established, it can be much harder.
2. Substitution
Replace the hazard with something less hazardous. Examples include using a lower-voltage supply where the application allows, a less toxic cleaning agent, a smaller or lighter container for manual handling, or a software design that asks for confirmation before a destructive action. Substitution needs care, because a replacement can bring new problems. A “safer” alternative should be checked to make sure it does not introduce a different hazard or reduce performance in an unacceptable way.
3. Engineering controls
Isolate people from the hazard through physical or built-in means, without relying on anyone’s choices. Guards on moving parts, interlocks that cut power when a door is opened, ventilation that removes fumes, enclosures around noisy equipment, current limiting in a circuit, and fail-safe designs all fall here. Good engineering controls work whether or not the person is paying attention. Asking how each control itself could fail, as failure modes analysis does, is a sensible habit. Their weaknesses are that they can be bypassed, may fail without notice, and need inspection and maintenance. Choosing and sizing them well draws on ideas like design margins.
4. Administrative controls
Change how people work. This covers procedures, training, signs and labels, scheduling to limit exposure, permits for risky tasks, supervision and checklists. Such measures are often cheap and quick, and sometimes they are the only practical option. But they depend on people reading, remembering and following them, in a workplace where time pressure, fatigue and distraction are real. Clear written procedures improve their reliability, and good safety culture supports them, but they remain more vulnerable than higher levels.
5. Personal protective equipment
Gloves, eye protection, hearing protection, respirators, helmets and similar equipment protect the individual when other measures have not removed the hazard. PPE is important and often essential, but it is placed last because it protects only the wearer, does nothing to reduce the hazard itself, depends on correct selection, fit, use and maintenance, and can be uncomfortable or interfere with the task. It is best seen as the final layer, not the main plan.
A worked illustration
Imagine a workshop where a bench-top machine throws off small metal chips. Consider how each level might apply. These are illustrations, not recommendations for a particular situation.
| Level | Possible measure |
|---|---|
| Elimination | Redesign the part so the cutting step is not needed |
| Substitution | Use a process that produces larger, slower-moving waste, or a different material |
| Engineering controls | Fit a fixed screen and a chip-catching enclosure |
| Administrative controls | Written procedure, training, marked zone where only operators may stand |
| PPE | Eye protection for operators and anyone nearby |
A real situation would likely use more than one of these. The point is that the lower rows are weaker if used alone, and that the best plans start by asking whether the upper rows are possible.
Using the hierarchy in practice
Start at the top, but stay realistic
The hierarchy is a way to prompt better thinking, not a rule that you must always use the top level. Sometimes elimination is not possible, or substitution is impractical, or the cost of a higher-level control is out of proportion to the risk. Many organisations are expected to reduce risk as far as is reasonably practicable, with legal definitions that differ between countries. Qualified safety professionals can help judge what is appropriate.
Combine layers
Layered measures give protection if one fails. A guard (engineering), a procedure about when to open it (administrative) and eye protection (PPE) together offer more resilience than any alone. Layers work best when they fail independently of one another.
Consider the whole lifecycle
Hazards appear during installation, normal use, maintenance, cleaning and disposal. A control that works during normal operation may be removed or disabled during maintenance. Thinking across the product lifecycle reveals where controls need to be reconsidered.
Beware of “be more careful”
A proposed action in an incident review that amounts to “remind staff to be careful” sits at the weak end of administrative controls. It may be appropriate as a supplement, but it is rarely sufficient. Asking where an action sits on the hierarchy is a quick test of whether it is likely to hold up. Reviews that focus on systems, such as blameless reviews, tend to produce stronger actions for this reason.
Check for new hazards
Any change, even a safety improvement, can introduce new hazards or move the risk elsewhere. A new guard may block a view, or an interlock might encourage bypassing if it is annoying. Review the change using the same hazard identification thinking applied to the original.
Beyond physical hazards
The ranking is also useful in other domains. In a software system, eliminating a dangerous function, substituting a safer default, adding automatic limits (an engineering control), writing a runbook (administrative) and giving users warnings (closer to PPE in spirit) follow a similar pattern. Analogies are imperfect, but the principle that built-in protection beats reliance on perfect behaviour carries over well.
Limits of the model
The hierarchy does not tell you how large a risk is, nor how to weigh competing risks. It ranks the dependability of types of controls in general, and a well-implemented lower-level control can beat a badly implemented higher one. It also does not guarantee safety. Outcomes remain uncertain, and controls need testing, inspection and maintenance. Use it as one tool among others, with the standards, regulations and expert advice that apply to your industry and location.