Hierarchy of Controls Explained: 5 Levels for Risk Reduction

The hierarchy of controls is a five-level decision model for reducing workplace exposure before the organization asks people to compensate with attention, discipline, or PPE. This F7 explainer defines the model, shows how the 5 levels differ, and explains why the strongest safety decision is usually made before the worker reaches the task.

The hierarchy of controls is a risk-reduction framework that ranks controls from most effective to least effective: elimination, substitution, engineering controls, administrative controls, and personal protective equipment. It helps EHS managers choose controls that remove or isolate hazards before relying on procedures, training, supervision, or PPE.

Definition of the hierarchy of controls

The hierarchy of controls is a structured way to choose risk controls by their expected reliability. NIOSH explains that the preferred order has 5 levels, and that elimination, substitution, and engineering controls are more effective because they reduce exposure with less dependence on constant human action.

The model matters because a control list can look complete while still leaving the person closest to the hazard carrying most of the risk. The practical question is not whether the risk assessment names a control. The question is whether the control removes the hazard, isolates the worker, changes the work system, or merely asks the worker to be perfect.

NIOSH states that the hierarchy should be followed from top to bottom, beginning with elimination and ending with PPE. That sequence is why the model fits risk assessment, Job Safety Analysis, Management of Change, procurement, and corrective action review.

As Andreza Araujo argues in Safety Culture: From Theory to Practice, culture becomes visible in repeated decisions. The hierarchy of controls exposes those decisions because it shows whether leaders redesign exposure or transfer the final burden to the worker.

The 5 levels of the hierarchy of controls

The 5 levels move from hazard removal to worker protection, and each step down the hierarchy usually increases dependence on procedures, supervision, training, behavior, and maintenance. A mature EHS review does not automatically reject lower-level controls, but it should require a clear reason before accepting PPE or administrative controls as the main defense.

Elimination

Elimination removes the hazard from the work. If the chemical, energy source, manual lift, confined-space entry, or exposure step disappears, the worker no longer has to manage that risk during the task.

Substitution

Substitution replaces the hazard with a safer material, method, tool, process, or design. It reduces risk only when the replacement is tested for new hazards before rollout.

Engineering controls

Engineering controls isolate people from the hazard through guards, ventilation, interlocks, barriers, automation, local exhaust, physical separation, or built-in design features.

Administrative controls

Administrative controls change the way people work through procedures, training, permits, rotation, signage, supervision, access rules, exposure time limits, and work planning.

Personal protective equipment

PPE protects the worker at the point of exposure through gloves, respirators, hearing protection, hard hats, eye protection, fall-arrest equipment, and other worn equipment.

The trap is treating all 5 levels as equivalent because they appear in the same risk assessment. They are not equivalent. A guard that prevents contact with a moving part has a different failure profile from a warning sign that tells the worker to stay clear.

How to apply the hierarchy in a risk assessment

The hierarchy should be applied before the team approves the residual risk, because control choice determines whether the operation removes exposure or merely documents it. OSHA recommends identifying control options, selecting controls through the hierarchy, developing a hazard control plan, implementing the plan, and following up to confirm that controls remain effective.

For a 300-employee plant, a practical review can use 4 questions. Can the task be removed or automated? Can the material, tool, or method be replaced? Can the hazard be isolated through engineering? If not, which administrative controls and PPE will protect people while stronger controls are developed?

OSHA recommends selecting controls that are feasible, effective, and permanent, while also involving workers who understand real field conditions. That worker input is essential because a control that looks elegant in a meeting may fail when maintenance access, shift pressure, contractor interface, or emergency work changes the task.

Across 25+ years leading EHS at multinationals, Andreza Araujo has seen that weak assessments often jump straight from hazard to procedure. The stronger habit is to challenge the control level first, then use a risk matrix only after the team has named the actual control and verification evidence.

When PPE is still necessary

PPE is still necessary when higher-level controls cannot remove exposure fully, when interim protection is needed, or when residual exposure remains during nonroutine work. The problem is not PPE itself. The problem is using PPE as the main proof that a serious hazard is controlled when elimination, substitution, engineering, or work redesign was never seriously tested.

HSE puts the warning plainly in its PPE guidance: PPE should be the last resort, and the risk assessment should consider elimination, substitution, engineering controls, administrative controls, and PPE in that order. That order matters for chemical exposure, noise, hot work, lifting, line breaking, and work at height.

HSE explains that PPE must be selected carefully and that workers need training to use it properly and report faults. In practice, that means PPE programs need fit, inspection, replacement, storage, supervision, and monitoring, not only a purchase order.

Andreza Araujo's Portuguese title A Ilusao da Conformidade, glossed as The Illusion of Compliance, is useful here because PPE can create visible compliance while the deeper exposure remains untouched. A worker wearing every required item may still be doing a poorly designed job.

Hierarchy of controls vs critical control verification

The hierarchy of controls helps choose stronger controls, while critical control verification proves whether selected controls work at the point of exposure. One ranks control strength; the other checks control health. A program needs both, because a high-level control can degrade and a low-level control can be overtrusted.

The ISO 45001 management-system logic also supports this separation because risk control belongs inside planning, operation, performance evaluation, and improvement. ISO states that ISO 45001:2018 includes hazard identification, risk assessment, worker participation, emergency planning, incident investigation, and continual improvement.

Connect the hierarchy with critical control verification whenever the exposure has SIF potential. If a control can prevent a fatality, the organization should know its level in the hierarchy and its current condition in the field.

Conclusion

The hierarchy of controls gives EHS managers a disciplined way to avoid treating all controls as equal. Its 5 levels place elimination and substitution above engineering controls, administrative controls, and PPE because stronger controls reduce exposure before the worker has to manage it personally.

For leaders, the next step is to audit the last 10 risk assessments and identify where PPE or procedures became the primary defense without a documented challenge of elimination, substitution, or engineering. If that pattern appears, Andreza Araujo's safety culture and risk diagnostics can help reconnect control choice, field verification, and leadership accountability through Andreza Araujo.