Guide

The Hierarchy of Controls

Once you know what could cause harm, the hierarchy of controls tells you *what to do about it* — ranking your options from the most effective (removing the hazard entirely) down to the least (relying on protective equipment).

Generate a risk assessment How to do a risk assessment

An inverted pyramid showing the five levels of the hierarchy of controls, from elimination at the wide top down to PPE at the narrow bottom. — The hierarchy is usually drawn as an inverted pyramid: the controls at the top are the most effective, and reliance narrows as you move down.

Why the order matters

Not all safety controls are equal. Putting up a warning sign and eliminating a hazard both “address” a risk on paper, but one is far more reliable than the other. The hierarchy of controls is the internationally recognised way of ranking control measures by how effective they are — and it exists because the most tempting options are often the weakest.

The principle is simple: the higher up the hierarchy you can act, the better. Controls at the top remove or reduce the hazard itself, so they don't depend on people behaving perfectly. Controls at the bottom — signs, procedures, and PPE — rely on human behaviour every single time, which is exactly where safety systems tend to fail. You should always try to control a risk as high up the hierarchy as is reasonably practicable before falling back to a lower level.

The five levels, most to least effective

Work down this list. Only move to the next level when a higher one isn't reasonably practicable — and combine levels where you can.

1
Elimination — remove the hazard entirely
The most effective control: get rid of the hazard so it can't cause harm at all. Do the work at ground level instead of at height, or design out a dangerous process step. If the hazard is gone, there is nothing left to manage.
2
Substitution — swap it for something safer
Replace the hazard with a less dangerous alternative — a water-based solvent instead of a toxic one, or a quieter machine. The task still happens, but the potential for harm is lower.
3
Engineering controls — isolate people from the hazard
Physically separate people from the hazard: machine guards, ventilation and extraction, barriers, guardrails, or interlocks. These work without depending on the person, which is why they sit above the behavioural controls.
4
Administrative controls — change the way people work
Procedures, safe systems of work, training, signage, permits, job rotation, and scheduling noisy work for quiet periods. Useful and often necessary, but they rely on people following them consistently, so they are not a substitute for the levels above.
5
PPE — protect the individual as a last line
Hard hats, gloves, respirators, hearing protection, and harnesses. PPE only protects the wearer, only works when worn correctly, and does nothing to reduce the hazard itself — so it is the *last* line of defence, not the first.

The hierarchy applied to one hazard

Here's how the five levels play out for a single, common hazard — welding fume in a workshop. In practice you often use several levels together.

Level of control	How it works	Example — welding fume
Elimination	Remove the hazard from the task altogether.	Use a bolted or bonded joint so no welding is required.
Substitution	Swap in a process or material that produces less harm.	Choose a welding process or consumable that generates less fume.
Engineering	Isolate people from the hazard with physical measures.	Local exhaust ventilation (fume extraction) at the weld point.
Administrative	Change how and when the work is done.	Limit exposure time, train welders, and restrict access to the bay.
PPE	Protect the individual as the last line.	Supplied-air or powered respirators for the welder.

Notice that PPE alone would leave the fume in the air for everyone nearby — the higher levels are what actually reduce the hazard.

Common mistakes

Most weak control choices come down to reaching too low on the hierarchy, too soon.

Jumping straight to PPE

PPE is visible and cheap, so it's tempting to start there. But it's the least reliable control — always look higher first.

A sign instead of a fix

A warning sign is an administrative control. It informs people of a hazard but does nothing to reduce it. Use it to support stronger controls, not replace them.

Treating levels as either/or

The best outcomes usually stack several levels — for example, extraction (engineering) plus training (admin) plus a respirator (PPE).

Set and forget

Controls degrade: guards get removed, filters clog, procedures drift. Re-check them whenever you review the assessment.

Where the hierarchy fits in a risk assessment

The hierarchy of controls is the engine behind step three of a risk assessment — *deciding on precautions*. Once you have identified the hazards and scored each one on a risk matrix, you use the hierarchy to choose controls that bring the residual risk down as far as is reasonably practicable.

RiskForms builds this in: when it drafts your assessment it proposes controls that start at the top of the hierarchy, so your document reflects best practice rather than defaulting to “wear PPE.”

Keep reading

How to do a risk assessment

Step-by-step walkthrough

What is a risk assessment?

Definition & legal context

Hazard identification

Spotting hazards before work

Risk matrix explained

5×5 likelihood × consequence

Hierarchy of controls

Elimination through to PPE

Job Hazard Analysis (US)

OSHA JHA / JSA

SWMS (Australia)

Safe Work Method Statement

RAMS (UK)

Risk Assessment & Method Statement

SSSP (New Zealand)

Safe System of Work Plan

Job Hazard Analysis (Canada)

Provincial & federal JHA

Put stronger controls in your next assessment

Describe the job and RiskForms drafts a region-specific risk assessment with controls ranked by the hierarchy — ready to review and sign.

Try RiskForms free

Why the order matters

The five levels, most to least effective

Work down this list. Only move to the next level when a higher one isn't reasonably practicable — and combine levels where you can.

Elimination — remove the hazard entirely

The most effective control: get rid of the hazard so it can't cause harm at all. Do the work at ground level instead of at height, or design out a dangerous process step. If the hazard is gone, there is nothing left to manage.

Substitution — swap it for something safer

Replace the hazard with a less dangerous alternative — a water-based solvent instead of a toxic one, or a quieter machine. The task still happens, but the potential for harm is lower.

Engineering controls — isolate people from the hazard

Physically separate people from the hazard: machine guards, ventilation and extraction, barriers, guardrails, or interlocks. These work without depending on the person, which is why they sit above the behavioural controls.

Administrative controls — change the way people work

Procedures, safe systems of work, training, signage, permits, job rotation, and scheduling noisy work for quiet periods. Useful and often necessary, but they rely on people following them consistently, so they are not a substitute for the levels above.

PPE — protect the individual as a last line

Hard hats, gloves, respirators, hearing protection, and harnesses. PPE only protects the wearer, only works when worn correctly, and does nothing to reduce the hazard itself — so it is the *last* line of defence, not the first.