The hierarchy of controls in depth

After hazards are identified and risks rated, the critical decision is how to control them. The hierarchy of controls ranks control methods from most to least effective: elimination, substitution, engineering controls, administrative controls and personal protective equipment. Its central message is simple: controls that remove or physically block a hazard protect people far more reliably than controls that depend on people behaving correctly every time. The hierarchy appears in occupational health and safety law, standards and guidance in both Canada and the United States. This lesson explains each level with examples, why the order matters, how to combine controls, the role of design and prevention through design, and the common trap of defaulting to rules and PPE.

The five levels

The hierarchy is often drawn as an inverted pyramid, with the most effective controls at the top:

• Elimination: physically remove the hazard, for example by doing the work at ground level instead of at height, eliminating a hazardous process step, or removing an unnecessary chemical.
• Substitution: replace the hazard with something less hazardous, such as a water-based cleaner instead of a solvent, a smaller or lighter package, or a lower voltage tool.
• Engineering controls: isolate people from the hazard or reduce it at the source by physical means, such as machine guards, interlocks, local exhaust ventilation, enclosures, guardrails, lifting devices, noise barriers and automation.
• Administrative controls: change the way people work through procedures, permits, training, signs, warnings, scheduling, job rotation, supervision and maintenance programs.
• Personal protective equipment: equipment worn by workers, such as respirators, gloves, eye and face protection, hearing protection, hard hats, high-visibility clothing and fall arrest harnesses.

Why the order matters

Controls higher in the hierarchy are more effective because they act on the hazard itself or on the path between hazard and person, and they keep working regardless of attention, fatigue, training or time pressure. A guard on a saw protects the operator on a busy Friday afternoon as well as on Monday morning. Controls lower in the hierarchy depend on people: procedures must be known, remembered and followed; training fades; signs are ignored when familiar; PPE must be selected correctly, fitted, worn, maintained and replaced, and it protects only the wearer and only if it does not fail. PPE can also create new problems, such as heat stress, reduced vision or communication, and discomfort that leads people to remove it. For these reasons, laws and standards generally require employers to consider higher-level controls first and to use PPE when other controls are not practicable or as a supplement.

OSHA standards and guidance apply the hierarchy in several ways. Many health standards, such as those for respirable crystalline silica, require employers to use engineering and work practice controls to reduce exposures as far as feasible before relying on respirators. OSHA's Recommended Practices for Safety and Health Programs describe the hierarchy of controls as the basis for selecting controls, and the National Institute for Occupational Safety and Health (NIOSH) promotes the hierarchy widely. ANSI/ASSP Z10 and ISO 45001 also set out the hierarchy.

Elimination

Elimination is the most effective control because, once a hazard is gone, no one can be harmed by it. Elimination is often easiest at the design stage: designing a roof with parapets or a building with equipment at ground level eliminates fall hazards for maintenance; specifying prefabricated components assembled at ground level eliminates some work at height; designing processes without hazardous intermediates eliminates chemical exposure. In existing workplaces, elimination may involve questioning whether a task is necessary at all, removing unused chemicals and equipment, or using remote inspection tools such as drones and cameras so that people do not need to enter hazardous areas.

Substitution

Substitution replaces a hazard with something less hazardous. Examples include water-based paints and cleaners instead of solvent-based products; less toxic degreasers; pre-mixed or pelleted materials instead of fine powders, reducing dust; lighter packages and smaller containers, reducing manual handling risk; battery-powered tools instead of gasoline engines indoors, eliminating carbon monoxide; and lower-pressure or lower-voltage systems where they meet the need. Substitutes must be assessed carefully to make sure they do not introduce new or worse hazards, a problem sometimes called regrettable substitution, as happened when some solvents were replaced by others later found to be toxic.

Engineering controls

Engineering controls physically change the workplace, equipment or process to reduce exposure, and they work without relying on worker behavior once installed. They include isolation and enclosure, such as sound-proof booths and enclosed processes; guarding, such as fixed guards, interlocked guards, light curtains and two-hand controls; ventilation, especially local exhaust ventilation that captures contaminants at the source; mechanical aids such as hoists, lift tables and vacuum lifters; fall protection systems such as guardrails, covers and safety nets; barriers separating pedestrians from vehicles; and automated monitoring with alarms and shutdowns. Engineering controls must be designed properly, maintained and checked, because a ventilation system that is not working or a guard that is easily bypassed provides false security.

Administrative controls

Administrative controls change how work is organized and done. They include safe work procedures and permits; training and competency requirements; supervision; scheduling, such as doing noisy work when fewer people are present or limiting time in hot areas; job rotation to reduce repetitive strain; signs, labels and warnings; housekeeping; maintenance and inspection programs; buddy systems and check-in procedures for lone workers; and restricting access to hazardous areas. Administrative controls are essential in every workplace, and some, such as lockout procedures and permits, are critical for high-risk work. But because they depend on people, they are weaker on their own than engineering controls and need to be supported by supervision, auditing and a culture that makes following them practical.

Personal protective equipment

PPE is the last line of defense. It is necessary where hazards cannot be fully controlled by other means, as a temporary measure while better controls are installed, during emergencies, and as a backup to other controls. Effective PPE programs include hazard assessment to select the right equipment, proper fit and fit testing for respirators, training on use, limitations and care, inspection and maintenance, replacement schedules, and supervision to ensure use. Workers should be involved in selection, because uncomfortable or poorly fitting PPE is less likely to be worn. HSE-104 covers PPE in depth.

Combining controls

In practice, most hazards are controlled by a combination of measures at different levels, sometimes called layers of protection or defense in depth. Machine safety typically combines a guard (engineering), a lockout procedure for maintenance (administrative) and safety glasses (PPE). Working at height may combine a guardrail where possible, a fall arrest system where guardrails are impractical, training and rescue plans. The goal is that the failure of any single control does not lead to serious harm, especially for high-consequence hazards. When combining controls, give the greatest weight to those that directly stop the hazardous event or its consequences.

Prevention through design

Prevention through design (PtD) applies the hierarchy at the earliest stage, when buildings, equipment, processes and work are designed, because that is when elimination and substitution are easiest and cheapest. Examples include designing machines with maintenance points accessible from outside guards, designing buildings with permanent anchor points and parapets for roof work, choosing materials that do not require hazardous finishing, and laying out facilities to separate vehicles and pedestrians. In the United States, ANSI/ASSP Z590.3 sets out PtD concepts; NIOSH has promoted PtD since 2007. In Canada, CSA Z1002 and ISO 45001 call for hazards to be considered in design, and some provinces place duties on designers, owners and suppliers. Safety professionals and workers can contribute to design reviews to make sure lessons from operations reach designers.

The trap of defaulting to the bottom

Many assessments jump straight to administrative controls and PPE: "follow the procedure, wear gloves, be careful". These are often the easiest and cheapest measures to write down, but they leave the hazard in place and depend on perfect behavior. Signs of this trap include assessments where nearly every control is training, signage or PPE; repeated incidents despite retraining; and controls that workers say are impractical. Before accepting lower-level controls, ask: Can we eliminate this hazard? Can we substitute something less hazardous? Can we engineer it out or isolate people from it? If the answer is no, document why, and keep looking for better options as technology and budgets allow.

Why the hierarchy works

The hierarchy of controls ranks controls by how much they depend on human behavior. Elimination and substitution change the hazard itself, so they work regardless of what people do. Engineering controls isolate people from the hazard and usually work without anyone having to remember them, although they need maintenance. Administrative controls, such as procedures, training, scheduling and signs, depend on people knowing and following the rules every time, which is difficult when they are tired, rushed, distracted or new. PPE is the last line of defense because it protects only the wearer, must fit and be worn correctly, can fail without warning, and often makes work harder or less comfortable. Controls higher in the hierarchy also tend to protect more people, including visitors and the public, and to remain effective over the long term, which is why they usually give better value despite higher initial costs.

Combining controls

In practice, most hazards are controlled by a combination of measures from several levels. Welding fume, for example, might be controlled by choosing a lower-fume process, local exhaust ventilation at the arc, general ventilation in the shop, scheduling to limit the number of people nearby, training on positioning the head out of the plume, and a respirator where exposure monitoring shows it is still needed. The higher-level controls do most of the work, and the lower-level ones handle what remains. Combinations also provide defense in depth: if one control fails, others still provide some protection. When planning combinations, make sure each control is specified, assigned and verified, and that lower-level controls are not being used to avoid practicable higher-level ones.

When reviewing a control plan, a useful test is to ask, for each hazard, "Why can we not eliminate it, substitute it or engineer it out?" If the answer is only cost or habit, the higher-level options deserve a second look.