The hierarchy of controls is a model that ranks occupational risk control measures from most to least effective, across five levels: elimination, substitution, engineering controls, administrative controls and personal protective equipment (PPE). The higher a control sits, the less it relies on human behaviour and the more it removes the hazard at source.
The hierarchy of controls, also called the hierarchy of control measures, is a systematic method for deciding how to control exposure to an occupational hazard. Rather than treating every protective measure as equivalent, it ranks them by real-world effectiveness: at the top are actions that eliminate or reduce the hazard at source, and at the bottom are those that merely reduce a worker's exposure to a hazard that remains present.
The most widely used model is that of NIOSH (the US National Institute for Occupational Safety and Health), which defines five levels, from most to least effective: elimination, substitution, engineering controls, administrative controls and personal protective equipment (PPE). According to NIOSH, elimination, substitution and engineering controls are more effective because they control exposure without significant human interaction, whereas administrative controls and PPE require ongoing effort from workers and their supervisors.
Across Europe and the UAE, the same logic is embedded in regulation. EU Directive 89/391/EEC, the framework directive on safety and health at work, sets out general principles of prevention that require employers to combat risks at source and to give collective protective measures priority over individual protection. ISO 45001:2018 formalises the sequence in clause 8.1.2, requiring organisations to apply the hierarchy when planning controls. In the UAE, occupational safety frameworks such as the federal MoHRE regulations and Abu Dhabi's OSHAD-SF apply the same risk-control priority.
The hierarchy is not a menu of equal options. It is an order of priority. The right question is never simply "what PPE should the worker wear?", but "can this hazard be eliminated? If not, can it be substituted? If not, can it be isolated through engineering?". PPE only enters once the higher options have been exhausted, or while they are being implemented.
The hierarchy provides an objective basis for justifying investment in risk control and defending decisions in audits. An action plan that jumps straight to PPE, without showing that the higher levels were assessed, is a classic weakness in ISO 45001 audits and inspections. Documenting the hierarchical reasoning matters as much as implementing the control itself.
Controls at the top of the hierarchy usually carry a higher upfront cost but a lower operating cost over time, especially when they protect multiple workers at once. NIOSH notes that engineering controls, despite the initial investment, tend to generate lower long-term operating costs than solutions relying on continual replacement and recurring training, such as PPE. For the financial decision, the hierarchy is a long-term risk management tool, not a compliance cost.
Measures at the lower levels, such as administrative controls and PPE, demand permanent effort from operations: training, rotation, supervision, inspection and equipment replacement. Understanding the hierarchy helps HR and operations size the management burden each control type imposes and prioritise solutions that reduce reliance on individual behaviour.
Each level answers a different question about the hazard. Working through them top to bottom is the correct way to build a robust control plan.
Elimination physically removes the hazard. It is the preferred solution, because with no hazard there can be no exposure. Examples include changing the work process to stop using a toxic chemical, automating a hazardous task so no one has to perform it, or removing the need to work at height by designing maintenance at ground level. Elimination is easier and cheaper at the design stage than after a process is running.
Substitution replaces the source of the hazard with a safer alternative. NIOSH's classic example is using plant-based printing inks instead of solvent-based inks. When substituting, it is essential to compare the new risks against the original ones, so as not to introduce new hazards. Like elimination, substitution is most effective and cheapest when applied at the design stage or when selecting new equipment and materials.
Engineering controls isolate people from the hazard through physical changes to equipment or the environment: protective barriers, enclosure, local exhaust ventilation, interlock systems, machine guarding. According to NIOSH, the most effective engineering controls are part of the original equipment design, block the hazard at source before it reaches the worker, cannot easily be bypassed and need minimal user action to work.
Administrative controls change the way people work, reducing the duration, frequency or intensity of exposure. They include operating procedures, training, job rotation, signage, adequate rest breaks, limiting access to hazardous areas and adjusting line speeds. They do not remove the hazard: they manage exposure to it, and therefore depend on continuous discipline and supervision.
PPE is equipment worn by the worker to minimise exposure: gloves, safety glasses, hearing protection, hard hats, respirators. It is the last level of the hierarchy. NIOSH is explicit: employers should not rely on PPE alone to control hazards when other effective control options are available. PPE can be effective, but only when the worker uses it correctly and consistently.
PPE sits at the base of the hierarchy for a structural reason: it does not remove the hazard, it merely places a barrier between the worker and a hazard that remains fully present. If that barrier fails, or is not used correctly, exposure happens immediately. Unlike an engineering control, which protects passively and continuously, PPE depends on three fragile conditions at once: the right equipment being available, being in good condition, and being used correctly all the time, by every exposed worker.
This shifts responsibility for control from the system to the individual. A poorly fitted respirator, hearing protection worn intermittently or a glove with an invisible tear cancels the protection with no warning. That is why NIOSH requires that, where PPE is needed, the employer implements a full PPE programme covering workplace hazard assessment, correct selection and use, inspection and replacement of damaged equipment, training and ongoing monitoring of effectiveness.
PPE may also appear cheaper at first, but it becomes costly over time, particularly when used daily by many workers. None of this makes PPE dispensable: it is mandatory while other controls are under development, when they cannot sufficiently reduce exposure, or when it is the only option available. The mistake is not using PPE; the mistake is using it as the first and only answer to a risk that could be controlled at source.
The hierarchy of controls is often confused with risk assessment, but the two perform distinct, complementary functions. Risk assessment identifies hazards and estimates the likelihood and severity of harm: it answers "what can go wrong and how big is the problem?". The hierarchy comes next: it answers "what to do about it, and in what order of priority?". A good risk assessment without a hierarchy of controls produces diagnoses without treatment; a hierarchy applied without risk assessment produces controls without focus.
In practice, the correct flow is to identify the hazard, assess the associated risk, then work through the hierarchy top to bottom to define the control. Once implemented, the control must be reassessed: did it reduce the risk to an acceptable level? If not, you need to move up the hierarchy or combine controls. This is why ISO 45001 treats the hierarchy within the cycle of continual improvement, not as a one-off decision.
Applying the hierarchy consistently is less about technical knowledge and more about process discipline. The sequence below works for almost any occupational hazard.
1. Identify the hazard precisely. Before thinking about a control, describe the hazard in concrete terms: what it is, where it occurs, who is exposed and under what conditions.
2. Ask whether it can be eliminated. Is there a way to remove the hazard entirely by redesigning the process, task or space? This question must always be asked first.
3. If not, consider substitution. Can the substance, material, equipment or method be replaced with a demonstrably safer alternative, without introducing new risks?
4. If not, design engineering controls. How can people be physically isolated from the hazard? Barriers, enclosure, ventilation, interlocks and guarding should be considered before any procedure.
5. Add administrative controls. Procedures, training, signage and access restrictions reduce residual exposure, but never replace the higher levels.
6. Specify the PPE required. Define PPE appropriate to the residual risk, with a programme for selection, inspection, training and replacement.
7. Reassess and document. Check whether the set of controls reduced the risk to an acceptable level, record the decision and review it periodically.
In most real cases, robust protection comes not from a single level but from combining several: an engineering control that removes most of the exposure, reinforced by administrative procedures and complemented by PPE for the residual risk. The hierarchy guides the priority of investment; it does not require choosing a single control.
On a metal stamping line, the crush hazard at presses can be eliminated by automating part feeding, so the operator never has to place a hand in the work zone. Where automation is not viable, engineering controls such as fixed guards, light-curtain sensors and interlock devices isolate the danger zone. Lockout/tagout (LOTO) procedures during maintenance and PPE such as cut-resistant gloves complete the set for residual risk.
In electrical network maintenance, the shock hazard can be eliminated by designing interventions that require no contact with live parts, or substituted by fully de-energising the circuit before work. Where live work is unavoidable, engineering controls (insulating barriers, temporary earthing) and administrative controls (permit-to-work, or PTW, and live-line procedures) govern exposure. Dielectric PPE is the final layer. In confined spaces at water treatment stations, forced ventilation (engineering) always precedes the use of respirators.
In handling volatile solvents, substitution with less toxic or less volatile alternatives is the preferred control. Where the hazardous substance is indispensable, local exhaust ventilation captures the contaminant at source before it reaches the worker's breathing zone. Handling procedures and appropriate respirators cover residual risk, but never replace well-designed extraction.
In pulp plants, exposure to bleaching agents such as chlorine dioxide is controlled primarily by enclosure and closed dosing systems (engineering), with continuous atmospheric monitoring. High noise from chippers and boilers is tackled first through engineering controls (acoustic enclosure, maintenance that reduces the noise source) and only then through exposure rotation and hearing protection.
In the production of high-potency active pharmaceutical ingredients (APIs), containment is the dominant principle: isolators, closed transfer systems and rooms with differential pressure (engineering) keep the compound contained before any reliance on PPE. Validated cleaning procedures and access control complement containment. Respirators and protective clothing enter only for the residual risk of specific tasks.
In industrial refrigeration systems using ammonia, the leak hazard is controlled first through engineering: gas detection, emergency ventilation, relief valves and isolated machine rooms. Emergency response procedures and training cover the failure scenario, and emergency respiratory PPE is the last layer. The same reasoning applies to confined spaces in tanks and to sanitation with aggressive chemicals.
The hierarchy is simple to state and hard to apply with discipline. The mistakes below are the ones that most undermine safety programmes.
The quality of hierarchy application shows up directly in safety indicators. Programmes that rely heavily on PPE and administrative controls tend to show greater variability in results, because performance depends on day-to-day human behaviour. Moving towards controls at the top of the hierarchy reduces exposure structurally and, over time, drives down indicators such as the total recordable incident rate (TRIR).
TRIR measures the number of recordable cases per 200,000 hours worked and is a lagging indicator: it shows what has already happened. The strength of the hierarchy is to act earlier, on the cause. By tracking how many risk controls sit at the higher levels of the hierarchy, versus how many depend on PPE and procedures, an organisation gains a leading indicator of the robustness of its prevention system.
To understand how the total recordable incident rate is calculated and interpreted, refer to the full page: [TRIR — Total Recordable Incident Rate].
For decades, the hierarchy of controls lived in spreadsheets, paper procedures and risk assessments filed away in binders. The problem was never the concept, but traceability: it was hard to know, at any moment, which controls were active, which had been reassessed and how many depended only on PPE. The hierarchical decision was recorded once and rarely revisited.
Digitalisation changes that. EHSQ software makes it possible to link each identified hazard to its risk assessment, to the chosen control and to its level in the hierarchy, creating a living, auditable record. Administrative controls such as permits-to-work and procedures gain an owner, a deadline and evidence of execution. Corrective and preventive actions (CAPA) arising from incidents or audits are tied to the control that failed, closing the loop between the event and system improvement.
More importantly, digital data capture at the point of operation, by the field operator, feeds leading indicators. Instead of discovering a control's weakness only after an accident, the organisation can correlate near misses, inspections and deviations with the controls that depend on human behaviour, anticipating where the hierarchy needs reinforcement. It is the difference between managing safety through the rear-view mirror and managing it looking ahead.
.webp)
It is a model that ranks occupational risk control measures from most to least effective, across five levels: elimination, substitution, engineering controls, administrative controls and PPE. The logic is always to prioritise the control that acts closest to the source of the hazard.
According to NIOSH: elimination (remove the hazard), substitution (swap in a safer alternative), engineering controls (isolate people from the hazard), administrative controls (change how people work) and personal protective equipment (PPE).
Because PPE does not eliminate the hazard: it only creates a barrier between the worker and a hazard that remains present. Its effectiveness depends entirely on correct and consistent use, which makes it the most fragile control and the most subject to human failure.
No. PPE is mandatory while other controls are under development, when they cannot sufficiently reduce exposure, or when it is the only option available. The mistake is not using PPE, but using it as the first and only answer to a risk that could be controlled at source.
An engineering control modifies the physical environment or equipment to isolate the hazard (for example, a barrier or ventilation) and works passively. An administrative control changes the way people work (procedures, training, rotation) and depends on continuous human effort.
In effect, yes. EU Directive 89/391/EEC requires employers to combat risks at source and give collective protection priority over individual protection. ISO 45001:2018, clause 8.1.2, requires organisations to apply the hierarchy when determining controls, and UAE frameworks apply the same priority.
The NIOSH model uses five levels. Some representations add a sixth element, such as "prevention through design", placed at the very top. The essence is the same: prioritise the control closest to the source. ISO 45001, in clause 8.1.2, adopts the same order of priority.
Yes, and in practice robust protection almost always combines several levels: an engineering control that removes most of the exposure, reinforced by procedures and complemented by PPE for the residual risk. The hierarchy guides priority; it does not require choosing a single control.
Risk assessment identifies and sizes the hazard; the hierarchy defines what to do about it and in what order. First you assess the risk, then work through the hierarchy top to bottom, and finally reassess whether the control reduced the risk to an acceptable level.
EHSQ software links each hazard to its control and to the corresponding level in the hierarchy, makes procedures and permits traceable with an owner and deadline, ties corrective actions to the control that failed and feeds leading indicators. Glartek was designed for this: connecting field-operator data capture to risk management, turning the hierarchy of controls into a living, auditable record rather than a forgotten document.
Request your demo
Start your EHSQ software journey with Glartek and become a leader in your industry.
Schedule Demo.webp)
Discover the power of the only AI-Native EHSQ software built for the frontline
.webp){kind=small}
