Hierarchy of Controls in Risk Management

The hierarchy of controls is a systematic framework for reducing risks in the workplace. It ranks control measures from most effective to least effective, ensuring you prioritise the best solutions rather than reaching for the easiest or cheapest option.

What is the hierarchy of controls?

The hierarchy of controls is a ranked system for selecting the most effective ways to reduce or eliminate workplace hazards. It's based on a simple principle: some control measures are inherently more reliable and effective than others.

The hierarchy helps you make better decisions when conducting risk assessments. Instead of jumping to the most familiar or convenient control measure, you work through the hierarchy from top to bottom, implementing the highest level of control that's reasonably practicable.

The five levels of control

The hierarchy has five levels, ranked from most effective (top) to least effective (bottom):

1. Elimination — Remove the hazard entirely

Elimination means physically removing the hazard so the risk no longer exists. This is by far the most effective control because if the hazard isn't there, it can't harm anyone.

Examples of elimination:

• Stop using a hazardous chemical and use a non-hazardous alternative instead
• Redesign a process to remove a dangerous step
• Automate a task so workers don't need to do it manually
• Remove trip hazards by reorganising workspace layout
• Eliminate work at height by bringing the task to ground level
• Delete unnecessary lone working by changing shift patterns or work allocation

2. Substitution — Replace with something less hazardous

If you can't eliminate the hazard entirely, substitute it with something that presents a lower risk. You're still doing the task, but using safer materials, equipment, or methods.

Examples of substitution:

• Use a water-based paint instead of solvent-based (lower toxicity, no flammability risk)
• Replace a toxic cleaning chemical with a less harmful alternative
• Use plastic pallets instead of wooden ones (no splinters, lighter weight)
• Switch from powder to pellet form of a chemical (reduces dust inhalation risk)
• Use battery-powered tools instead of petrol tools indoors (no exhaust fumes)
• Replace glass bottles with plastic containers (eliminates laceration risk)

3. Engineering controls — Isolate people from the hazard

Engineering controls use physical measures to separate workers from hazards. They don't remove or replace the hazard, but they reduce exposure by changing the work environment or equipment.

Examples of engineering controls:

• Install machine guards to prevent access to dangerous moving parts
• Use local exhaust ventilation (LEV) to remove dust or fumes at source
• Build barriers, rails, or covers to prevent falls
• Install sound-dampening enclosures around noisy equipment
• Use extraction systems for welding fumes
• Implement isolation procedures (lockout/tagout) for maintenance work
• Install automated handling systems to reduce manual lifting
• Use residual current devices (RCDs) for electrical safety

Engineering controls are generally reliable because they don't depend on worker behaviour. Once installed and maintained, they provide continuous protection.

4. Administrative controls — Change how people work

Administrative controls reduce risk by changing work procedures, schedules, training, or supervision. They rely on people following rules and procedures consistently.

Examples of administrative controls:

• Written safe systems of work or standard operating procedures
• Job rotation to limit exposure time to a hazard
• Reducing shift lengths to limit exposure duration
• Training workers on safe practices
• Implementing permit-to-work systems for high-risk tasks
• Installing warning signs and labels
• Scheduling noisy work when fewer people are present
• Conducting regular inspections and audits
• Implementing supervision and monitoring systems
• Creating exclusion zones around hazards

Administrative controls are less reliable than higher-level controls because they depend on:

• Workers understanding and remembering procedures
• Workers consistently following the rules
• Supervisors enforcing compliance
• Procedures staying up to date as work changes

5. Personal Protective Equipment (PPE) — Protect the individual

PPE is equipment worn by workers to protect them from hazards. It's the last line of defence and the least effective control measure because it:

• Only protects the person wearing it (not others)
• Relies on workers selecting, wearing, and maintaining it correctly
• Can fail, be damaged, or worn incorrectly without anyone noticing
• May be uncomfortable, reducing compliance
• Must be replaced regularly, creating ongoing costs

Common types of PPE:

• Safety helmets and hard hats
• High-visibility clothing
• Safety footwear (steel toe caps, slip-resistant soles)
• Eye protection (safety glasses, goggles, face shields)
• Hearing protection (ear plugs, ear defenders)
• Respiratory protection (masks, respirators)
• Gloves (cut-resistant, chemical-resistant, heat-resistant)
• Fall arrest harnesses
• Protective clothing (chemical suits, heat-resistant aprons)

Why order matters: Most to least effective

The hierarchy isn't arbitrary — it's based on reliability and effectiveness:

Effectiveness hierarchy explained:

Elimination (100% effective) — If the hazard doesn't exist, there's no risk. This is the only control that guarantees zero harm.

Substitution (very high effectiveness) — A significantly less hazardous alternative dramatically reduces the potential severity and likelihood of harm.

Engineering controls (high effectiveness) — Physical barriers and systems work continuously and don't require constant human intervention to be effective.

Administrative controls (moderate effectiveness) — People make mistakes, forget procedures, take shortcuts, or haven't been trained. These controls only work when followed perfectly.

PPE (low to moderate effectiveness) — Has all the problems of administrative controls, plus can be defective, worn incorrectly, damaged, or simply not worn at all. It's also the only control that does nothing to reduce the hazard itself.

Application in risk assessments

When conducting a risk assessment, use the hierarchy to identify control measures:

The systematic approach:

1. Identify the hazard (e.g., workers exposed to harmful dust during cutting operations)

2. Work down the hierarchy, asking at each level:

   • Elimination: Can we stop doing this task? Can we avoid creating dust?
   • Substitution: Can we use a different material or method that creates less dust?
   • Engineering: Can we extract the dust at source (LEV)? Can we enclose the process?
   • Administrative: Can we reduce exposure time? Can we train workers on dust control?
   • PPE: What respiratory protection is needed as a final backup?

3. Implement the highest practicable level(s) — Often you'll use multiple levels together (e.g., LEV + training + respirators for residual risk)

4. Document your reasoning — Explain why you didn't use higher-level controls if you've had to go lower down the hierarchy

Legal basis in UK law

The hierarchy of controls is embedded in the Management of Health and Safety at Work Regulations 1999, Schedule 1, which sets out the "principles of prevention":

1. Avoiding risks (elimination)
2. Evaluating risks which cannot be avoided (assessment)
3. Combating risks at source (substitution and engineering)
4. Adapting work to the individual (reducing exposure)
5. Adapting to technical progress (use better methods when available)
6. Replacing the dangerous with the non-dangerous or less dangerous (substitution)
7. Developing a coherent prevention policy (comprehensive approach)
8. Giving collective protective measures priority over individual protective measures (engineering over PPE)
9. Giving appropriate instructions (administrative controls)

This legal framework means you can't simply choose your preferred control measure — you must justify why you haven't used higher-level controls.

Common mistakes: Jumping straight to PPE

The most common error is defaulting to PPE and procedures without considering higher-level controls. This happens because:

• PPE seems quick and cheap to implement
• Businesses are familiar with PPE (gloves, goggles, etc.)
• Training is easier than redesigning processes
• People underestimate the long-term costs of lower-level controls

Why this is problematic:

Example: Chemical handling

Wrong approach:

• Hazard: Corrosive cleaning chemical splashes
• Control: Provide gloves, goggles, aprons
• Training: "Remember to wear your PPE"

Problems:

• Workers must wear uncomfortable PPE in hot conditions
• Compliance is inconsistent
• PPE degrades and must be replaced regularly
• Doesn't protect against large spills or accidents
• Creates ongoing training and monitoring burden

Better approach using hierarchy:

1. Eliminate: Can we clean without this chemical? (e.g., steam cleaning instead)
2. Substitute: Can we use a less corrosive product? (pH neutral alternative)
3. Engineering: Can we use automatic dispensing to prevent splashes? Enclosed systems?
4. Administrative: Reduce how often we use it? Limit who handles it?
5. PPE: As final backup for residual splashing risk

The better approach reduces the hazard dramatically before PPE even comes into play.

Practical implementation: Combining controls

In practice, you'll often use multiple levels together for effective risk control:

Example: Workplace noise control

Level 1 - Elimination:

• Remove the noisiest process entirely (consider if it's necessary)

Level 2 - Substitution:

• Replace pneumatic tools with quieter electric alternatives
• Use vibrating screens instead of impact screens

Level 3 - Engineering:

• Install acoustic enclosures around noisy machinery
• Use sound-dampening materials on floors and walls
• Relocate noisy equipment away from workers
• Install silencers on exhaust outlets

Level 4 - Administrative:

• Limit time workers spend in high-noise areas
• Rotate workers to reduce individual exposure
• Schedule noisy operations when fewer people are present
• Provide quiet rest areas

Level 5 - PPE:

• Supply appropriate hearing protection as final layer
• Train workers on correct use and fitting
• Ensure regular replacement

Notice how PPE is the last resort, used only for residual noise that can't be controlled by higher-level measures.

Documentation: Recording your decisions

When documenting risk assessments, record:

For each control measure you've selected:

• Which level of the hierarchy it represents
• Why you chose this control
• What it's intended to achieve

For higher-level controls you didn't use:

• Why they weren't reasonably practicable
• What specific barriers prevented their use (e.g., technical limitations, disproportionate cost)

Example documentation:

Hazard: Exposure to welding fumes

Controls considered:

• Elimination: Not practicable — welding is essential to production
• Substitution: Investigated alternative joining methods (adhesives, mechanical fasteners) — not suitable for structural integrity requirements
• Engineering: Local exhaust ventilation (LEV) installed at all welding stations — IMPLEMENTED
• Administrative: Welding procedures written, all welders trained in fume minimisation techniques — IMPLEMENTED
• PPE: RPE (FFP3 respirators) provided for operations where LEV cannot achieve adequate control — IMPLEMENTED

Justification: Cannot eliminate or substitute welding. Primary control is LEV (engineering). Admin controls support correct use. PPE provides backup for residual exposure.

This documentation demonstrates you've applied the hierarchy systematically, not just grabbed the easiest option.

Frequently asked questions

Next steps

Now that you understand the hierarchy of controls, apply it to your risk assessments:

Five Steps to Risk Assessment →

Want to ensure your risk assessments are suitable and sufficient?

What makes a risk assessment suitable and sufficient? →

Related articles:

• What is a risk assessment?
• Five steps to risk assessment
• Suitable and sufficient risk assessments

Useful tools:

• Risk Assessment Generator
• Responsibility Checker