Hierarchy of Controls vs Prevention through Design vs PPE: Which Choice Should Lead a New Equipment Project?

A new machine can be compliant, efficient, and still leave workers dependent on a face shield, a warning label, or perfect attention whenever the process changes. This comparison helps EHS managers and project leaders decide whether the hierarchy of controls, Prevention through Design, or PPE should lead the safety decision before the equipment becomes normal work.

The central question is not which tool sounds most rigorous. It is which intervention changes the exposure at its source, which barrier remains reliable when production is under pressure, and which evidence will show that the decision still works during maintenance, cleaning, recovery, and other conditions that the original design review may have treated as exceptions.

Why the three approaches are often confused

The hierarchy of controls, Prevention through Design, and PPE operate at different levels. The hierarchy provides a ranking of control strength, Prevention through Design brings that ranking into the life of a project, and PPE protects the individual from exposure that remains after stronger opportunities have been considered. Treating them as interchangeable makes the review sound complete while leaving the decision logic unclear.

ANSI/ASSP Z590.3 gives Prevention through Design a practical place in the project lifecycle because risks can be reduced more effectively when the team can still change the concept, layout, materials, energy sources, access, or maintenance method. Once the asset is installed, the same change may require a shutdown, a retrofit, or a new administrative burden that nobody budgeted for.

Andreza Araujo’s work across 25+ years of executive EHS leadership and more than 250 cultural transformation projects supports a simple test. If the project team can describe the hazard but cannot explain which design decision prevents the exposure, the review has identified a concern without yet owning the control.

Evaluation criteria for a new equipment decision

A useful comparison needs more than a general statement that engineering controls are better than PPE. Evaluate each option against seven dimensions that reflect how equipment behaves after commissioning.

• Point of intervention. Does the option change the hazard, the path between hazard and person, the work method, or the worker’s last line of defense?
• Dependence on behavior. Can the barrier work when attention is divided, the crew is unfamiliar, or production is recovering from a delay?
• Coverage. Does it protect one task and one person, or does it protect everyone who may enter the exposure zone?
• Abnormal work. Does it remain effective during cleaning, troubleshooting, jam clearing, startup, shutdown, and temporary arrangements?
• Verification. Can the organization test the barrier with observable evidence rather than assuming that installation equals performance?
• Lifecycle cost. What will procurement, maintenance, training, inspection, replacement, and change management require over the asset’s life?
• Residual exposure. What remains after the option is applied, and who owns the decision when that residual exposure changes?

These criteria prevent a project from selecting the cheapest visible response while ignoring the cost of repeated human dependence. They also create a common language between engineering, operations, procurement, maintenance, and EHS, which is essential because a control can fail at the handoff between those groups even when each department has completed its own task.

Hierarchy of controls, the decision logic

The hierarchy of controls is the strongest starting point when the team needs to decide how far upstream it should go. Elimination and substitution challenge the presence or nature of the hazard, engineering controls separate people from the hazard, administrative controls shape the work, and PPE protects the individual from residual exposure.

Its value is not the diagram. Its value is the challenge it creates when a project presents PPE as the default answer. A new solvent process may include gloves and goggles, yet the first questions should concern whether the substance can be eliminated, replaced, enclosed, mechanically transferred, or isolated from the operator. A project that skips those questions has not applied the hierarchy. It has only selected the lowest visible layer.

The hierarchy wins as the governing decision logic because it keeps the team from comparing controls at the same level. A warning sign and an interlocked guard are not equivalent options, even if both appear in the action list. One asks people to interpret and respond, while the other can prevent access under defined conditions.

Use the hierarchy at the concept stage, at design reviews, during procurement, and again when the operating method changes. The common trap is to apply it once, record that the project considered controls, and then allow later value engineering to remove the physical barrier that made the original decision credible.

Prevention through Design, the project-stage advantage

Prevention through Design should lead when the team can still influence the equipment, facility, process, or maintenance concept. It is especially valuable for decisions involving access, line of sight, energy isolation, manual handling, chemical containment, noise, ergonomics, traffic separation, and the location of people relative to moving or stored energy.

The advantage is reach at the moment when changes are comparatively easier to make. A designer can place an isolation point outside a line-of-fire zone, specify remote sampling instead of manual entry, or create a maintenance platform that prevents improvised climbing. Those decisions alter the work itself rather than asking a future operator to compensate for a weak arrangement.

Prevention through Design is not a promise that every hazard disappears. The project still has to examine commissioning, foreseeable misuse, contractor work, inspection access, obsolete components, and the tasks that happen only when something goes wrong. A design that is safe during production but unsafe during a jam has transferred the critical exposure to the least predictable moment.

Choose this approach when the project has decision rights and budget to change the source of exposure. Ask the design authority to show which hazards were eliminated, which were separated, which residual exposures remain, and how operations will verify the controls after handover. That evidence makes the design review accountable instead of ceremonial.

ANSI/ASSP Z590.3 Explained provides a useful companion when the team needs a deeper review of design decisions that prevent risk from becoming part of the blueprint.

Engineering controls, the barrier between people and exposure

Engineering controls should lead when the hazard cannot be removed but the exposure can be separated from people through a physical, mechanical, or automated barrier. Guards, interlocks, local exhaust ventilation, containment, remote operation, fixed access, and automatic shutdowns can reduce dependence on a person noticing danger at exactly the right moment.

The critical distinction is that engineering does not mean automatically reliable. A guard that is easy to bypass, an interlock that is not tested, or a ventilation system that loses performance without an alarm can create confidence without control. James Reason’s work on latent failures remains relevant because the visible barrier may be weakened by procurement choices, maintenance routines, staffing, or production incentives that sit outside the equipment drawing.

Engineering controls win against PPE when the exposure is frequent, severe, difficult to perceive, or likely to occur during divided attention. They also win when multiple people can enter the area, because a personal item cannot protect a worker who was not issued the correct equipment or who enters during an unplanned task.

Specify the failure condition before approving the control. The review should state what happens when power is lost, a sensor fails, a guard is removed, a filter is saturated, a component is bypassed, or a maintenance crew needs access. The control is not complete until the organization knows how it will detect degraded performance and who has authority to stop the work.

Administrative controls, the bridge that cannot carry the whole load

Administrative controls include procedures, permits, training, scheduling, supervision, labeling, competency requirements, and rules that shape how people perform the work. They remain necessary because every equipment project has tasks that cannot be fully automated or physically isolated, especially during inspection, changeover, maintenance, and emergency response.

They become dangerous when they are used to hide a design decision that the project did not want to fund. A procedure may instruct an operator to keep clear of a moving part, yet the project should still ask whether the part can be guarded or whether the task can be performed from outside the exposure zone. Training can explain the desired behavior, but it cannot make an inaccessible isolation point accessible or turn a poorly designed platform into a stable one.

Administrative controls are strongest when they support a physical barrier and define how the barrier will be used, inspected, changed, and restored. They are weakest when the entire risk reduction depends on memory, perfect sequencing, or a supervisor being present for every repetition of the task.

Use an administrative control as the lead option only when the exposure is temporary, variable, or genuinely resistant to stronger treatment, and document why the stronger options were not reasonably practicable. That explanation should be visible to the project owner, not buried in an EHS appendix that operations never reads.

PPE, the necessary final layer

PPE has a legitimate place in a new equipment project because residual exposure is common. Eye protection, hearing protection, respiratory protection, gloves, protective clothing, fall protection, and arc-rated equipment can reduce harm when stronger controls cannot fully remove the hazard.

PPE should not lead the project when it is being used to compensate for an unexamined design choice. It depends on correct selection, fit, compatibility, condition, availability, worker acceptance, training, storage, replacement, and consistent use during the exact moment when the task becomes difficult. Each dependency is a possible failure path, which means the project must treat PPE as a managed system rather than a purchase order.

PPE can be the best immediate response during commissioning or while a permanent engineering control is being built. It may also be the right answer for short-duration inspection, unusual maintenance, or exposure that varies by material and task. The weakness appears when a temporary arrangement becomes the operating standard and no one returns to ask whether the underlying design can be improved.

Require the project to identify the residual exposure that PPE addresses, the people who need it, the conditions that make it necessary, and the evidence that the program remains usable. If workers cannot perform the task comfortably enough to keep the PPE in place, the project has a human-factors problem that training alone will not solve.

Decision matrix for project leaders

The matrix below is not a scoring substitute for engineering judgment. It is a way to make the trade-off visible when a project team is deciding where to invest its next design hour or budget review.

Which option should lead in each project context?

When the project is still defining the concept, Prevention through Design should lead, with the hierarchy of controls governing the alternatives. The team should spend its effort on removing exposure, changing the process, separating people from energy, and making maintenance safer before it specifies training or PPE.

When the equipment is already selected and the hazard remains, engineering controls should lead the next review. The question becomes whether a guard, enclosure, interlock, local exhaust, remote method, or fixed access arrangement can prevent contact or reduce exposure without making the work impossible to perform.

When the exposure is variable or tied to a task that cannot be redesigned immediately, administrative controls can organize the work while a stronger solution is assessed. That interim status needs an owner and a deadline, because temporary controls become permanent when the organization stops asking what will replace them.

When residual exposure remains after those decisions, PPE should complete the control set. It should not close the conversation. The project owner still needs to know why exposure remains, how workers will use the equipment, and what evidence will trigger a new design review.

How to make the decision survive handover

The project is not safe because the design review was approved. It is safer when the operating team can demonstrate the intended control under normal work and under the conditions that force people to improvise. Handover should therefore include the hazard assumptions, the critical control, the failure modes, the inspection method, the response to degraded performance, and the authority to stop or change the work.

Invite operators, maintainers, contractors, and supervisors into the final review because each group sees a different part of the exposure. A designer may understand the mechanism, while a maintenance technician knows which access point will be ignored at 2 a.m. and a supervisor knows which instruction disappears when the line is behind schedule.

Andreza Araujo’s approach of combining engineering, creativity, and care is useful here because the best control must be technically sound and usable by the people who depend on it. Her book Safety Culture: From Theory to Practice reinforces the connection between repeated decisions and operating culture. If the project repeatedly accepts worker-dependent controls for hazards that could have been designed out, that pattern becomes a culture signal.

Use the decision as a living record. Revisit it after commissioning, after the first maintenance intervention, after a near miss, and whenever the process, material, staffing, or production rhythm changes. The strongest option on paper is not necessarily the strongest option in the field, where a control must remain visible, available, and credible when the work becomes less predictable.

Conclusion: choose the sequence, not the slogan

The hierarchy of controls should govern the decision, Prevention through Design should shape the project while change is still possible, engineering controls should separate people from exposure where elimination is not feasible, administrative controls should organize the remaining variability, and PPE should protect workers from residual risk. The mistake is not using PPE. The mistake is allowing PPE to become the first and final answer to a design problem.

Before approving a new equipment project, ask which exposure could have been removed, which barrier must not be weakened, what happens during abnormal work, and how the operating team will prove that the control still works. Those questions turn a safety review from a compliance checkpoint into a decision about how people will actually come home from work.