Hierarchy of Controls Explained: 5 Layers That Keep PPE in Its Place

When a team reaches for PPE before it asks whether the hazard can be removed, it is already solving the problem at the weakest layer. The hierarchy of controls explains the order that keeps safety decisions honest, and this quick guide shows how the five layers work in real work, not on a poster.

The hierarchy of controls is the order of preferred risk reduction measures: eliminate the hazard, substitute it, engineer out exposure, control the work administratively, and only then use PPE. When teams reverse that order, they ask the last barrier to do the job of the first four.

As Andreza Araujo argues in 100 Objeções de Segurança, PPE is the secondary line of defense, which means it reduces harm only after exposure already exists. James Reason's barrier thinking points in the same direction, because a system that leaves earlier layers weak ends up asking the person to carry too much risk alone.

Definition

The hierarchy of controls matters most when the task contains stored energy, moving parts, chemicals, or any condition that can injure before a worker has time to react. In maintenance, the question is rarely whether PPE helps. The real question is whether the hazard can be removed, reduced, or blocked upstream, where the control changes the work itself.

That is why the article on stored energy belongs in the same conversation. If the energy source is still live, a glove or face shield can reduce harm, but it cannot replace a control that prevents release in the first place.

The five layers

Elimination

Remove the hazard so the exposure no longer exists.

Substitution

Replace the hazard with a less dangerous option that still performs the task.

Engineering controls

Isolate people from the hazard with physical design, guards, interlocks, ventilation, or verification of zero energy.

Administrative controls

Change the way work is planned, sequenced, authorized, supervised, and handed over.

PPE

Protect the person after the earlier layers have done as much as they can.

The engineering layer is where a lot of operations still underperform, because the control often exists on paper while the field still depends on memory. The article on lockout/tagout verification shows why isolation must be proven, not assumed, especially when residual energy can return through a second source.

Administrative controls matter too, but they are weaker than design changes because they rely on people following a rule under pressure. The article on permit-to-work handover is useful here, since a clean handover can keep the task honest, while a bad handover simply passes confusion to the next shift.

How to tell whether the control is real

A real control changes exposure in the field. A decorative control changes only the paperwork. If the task still needs constant reminders, repeated exceptions, and a heroic supervisor to stay safe, the operation is not living at the right layer yet.

Andreza Araujo's point is practical: a company should not praise PPE purchase volume when the task itself still invites exposure. The right question is which layer removes the most risk with the least dependence on human luck, because that answer usually points to elimination or engineering before anything else.

When PPE belongs in the plan

PPE belongs in the plan when the earlier layers have already reduced the hazard as far as they reasonably can, or while a better control is being implemented. It does not belong as the excuse to delay redesign, because delay tends to harden into habit and habit tends to look like normal work.

If your operation still treats PPE as the first answer, start with the work itself and ask what can be removed, substituted, isolated, or simplified. Then use PPE to reduce the remaining exposure, not to disguise it. That order keeps the supervisor honest and the worker better protected.

If you want the deeper argument behind this position, Andreza Araujo's books at Andreza Araujo's store expand the same principle across safety culture, leadership, and risk management.

Conclusion

The hierarchy of controls works when the operation solves the problem as far upstream as possible and saves PPE for the last layer. That is the difference between real risk reduction and a comforting routine that still leaves the hazard in place.

When the task needs more than PPE to be safe, the next decision should be redesign, not reassurance. For organizations that want help turning that principle into field practice, Andreza Araujo can help connect the controls to the way work actually happens.