Hierarchy of Controls: A Complete Guide to Protecting Workers

Workplace safety is not a matter of luck, but it is the result of deliberate, structured decision-making. Every day, workers across industries face hazards ranging from chemical exposures and heavy machinery to extreme temperatures and ergonomic strain. The challenge for safety leaders is not simply identifying these hazards, but determining the most effective way to address them before someone gets hurt.

That is where the hierarchy of controls comes in. Developed by the National Institute for Occupational Safety and Health (NIOSH) and endorsed by the Occupational Safety and Health Administration (OSHA), the hierarchy of controls is a proven framework that helps organizations prioritize hazard control measures based on their effectiveness. Rather than defaulting to the easiest or cheapest solution, the hierarchy pushes safety professionals to pursue the most protective option available.

In this guide, we will break down each level of the hierarchy, explain why the order matters, walk through real-world examples, and show how organizations can apply this framework to build a stronger, more proactive safety culture.

What Is the Hierarchy of Controls?

The Core Principle Behind the Framework

The hierarchy of controls is a five-level framework that ranks hazard control strategies from most to least effective. It is typically illustrated as an inverted triangle or pyramid, with the highest-impact controls at the top and the lowest at the bottom. The five levels are elimination, substitution, engineering controls, administrative controls, and personal protective equipment (PPE).

Why the Order Matters

The core principle behind the hierarchy is straightforward: the closer a control gets to removing the hazard at its source, the more effective and reliable it will be. Controls at the top of the hierarchy do not depend on worker behavior or ongoing vigilance — they remove or redesign the hazard itself. Controls at the bottom, like PPE, rely entirely on human compliance and correct usage, making them inherently less dependable as standalone measures.

This does not mean that lower-level controls have no value. In many real-world situations, multiple levels of control are used together to provide layered protection. But the hierarchy ensures that organizations are always pushing toward the most effective solution rather than settling for the most convenient one.

Level 1: Elimination

What Elimination Means in Practice

Elimination is the most effective control measure because it completely removes the hazard from the workplace. If a hazard does not exist, it cannot cause harm. This is the gold standard of workplace safety and should always be the first option explored.

Real-World Examples of Elimination

Examples of elimination include discontinuing a process that uses a toxic chemical, removing a piece of equipment that poses a crush hazard, or redesigning a workflow so that workers are no longer required to perform a physically dangerous task. In construction, this might mean prefabricating components off-site so that workers spend less time working at height. In manufacturing, it might mean automating a process that previously required manual handling of heavy materials.

When Elimination Is and Isn't Feasible

Elimination is not always feasible, particularly in established operations where processes are deeply integrated into production. However, it should never be dismissed without genuine consideration. When redesigning a process or facility from scratch, elimination is the most cost-effective time to implement because changes are far less disruptive than retrofitting existing systems.

Level 2: Substitution

Replacing Hazards With Safer Alternatives

When a hazard cannot be fully eliminated, the next best option is substitution — replacing the hazardous material, process, or equipment with something less dangerous. Substitution reduces the risk at its source, even if it does not eliminate it entirely.

Common Substitution Examples Across Industries

Common examples include replacing a solvent-based cleaning product with a water-based alternative, switching from a highly toxic chemical to one with a lower hazard classification, using plastic components instead of lead-based materials, or replacing manual lifting with mechanical lifting aids. In the realm of noise control, substituting a loud piece of equipment with a quieter model is a substitution that can dramatically reduce the risk of occupational hearing loss.

Avoiding the Introduction of New Hazards

The key to effective substitution is ensuring that the replacement does not introduce a new hazard that is equal to or greater than the original. A thorough risk assessment should always accompany any substitution decision to confirm that the net result is a genuine reduction in risk.

Level 3: Engineering Controls

How Engineering Controls Work

Engineering controls involve modifying the work environment or equipment to reduce exposure to a hazard. Unlike elimination and substitution, engineering controls do not remove the hazard entirely — but they create a physical barrier or system that limits worker exposure without relying on behavioral change.

Why Engineering Controls Are Highly Reliable

This level of control is highly effective because it works independently of the worker. Once an engineering control is in place, it provides continuous protection whether or not the worker remembers to take a specific action. Examples include installing machine guarding to prevent contact with moving parts, adding local exhaust ventilation systems to capture airborne contaminants before they reach the worker's breathing zone, using noise enclosures around loud equipment, implementing interlock systems that shut down machinery when a safety guard is removed, and designing ergonomic workstations that reduce repetitive strain.

The Long-Term Cost Value of Engineering Controls

Engineering controls are often the most practical path forward when elimination and substitution are not feasible. They can be highly cost-effective over the long term, particularly when compared to the ongoing costs of PPE replacement, administrative training, and incident-related expenses.

Level 4: Administrative Controls

Changing How Work Is Organized

Administrative controls are changes to work policies, procedures, schedules, or practices that reduce worker exposure to hazards. Unlike the three levels above, administrative controls do not change the physical nature of the hazard — they change how work is organized around it.

Examples of Administrative Controls in the Workplace

Common examples include job rotation to limit the amount of time any one worker spends exposed to a repetitive strain hazard, establishing safe work procedures and standard operating procedures (SOPs), implementing permit-to-work systems for high-risk activities like confined space entry or hot work, scheduling maintenance tasks during off-peak hours to minimize the number of people exposed, providing safety training and safety awareness programs, and setting up warning signs or color-coded labeling systems.

The Limitations of Administrative Controls

Administrative controls can be effective when applied consistently, but their reliability depends heavily on human compliance. Workers must follow procedures correctly and consistently for these controls to work. This is why administrative controls are considered less reliable than the higher levels of the hierarchy and should always be used in combination with more robust measures where possible.

Level 5: Personal Protective Equipment (PPE)

Understanding PPE's Role in the Hierarchy

PPE is the last line of defense in the hierarchy of controls. It includes any equipment worn or used by a worker to protect against hazards — such as hard hats, safety glasses, gloves, hearing protection, respirators, high-visibility vests, and fall arrest harnesses.

Why PPE Is the Least Reliable Control Measure

PPE is at the bottom of the hierarchy because it does not eliminate or reduce the hazard itself. It only reduces the severity of harm if exposure occurs. Its effectiveness is entirely dependent on the worker selecting the correct type, wearing it properly, maintaining it in good condition, and using it every single time they are exposed to the hazard. Any one of these factors failing can result in injury.

When PPE Is Still Essential

That said, PPE remains an essential component of a comprehensive safety program. In many situations — particularly where higher-level controls are not yet in place, are being implemented, or are not technically feasible — PPE provides critical protection. It is also commonly used in conjunction with engineering and administrative controls to create multiple layers of defense. The important thing is that PPE should never be treated as a substitute for higher-level controls. Organizations that rely primarily on PPE to manage hazards are accepting a higher level of residual risk than is necessary.

Applying the Hierarchy of Controls in Practice

Step 1: Start With Thorough Hazard Identification

Understanding the hierarchy of controls in theory is one thing, and applying it consistently across a complex organization is another. The foundation of any effective control strategy is a thorough hazard identification process. You cannot control what you have not identified. Regular workplace safety inspections, job hazard analyses, incident investigations, and worker reporting systems all contribute to a more complete picture of where hazards exist.

Step 2: Work Through the Hierarchy Systematically

Once hazards are identified, work through the hierarchy from the top down. Ask whether the hazard can be eliminated before jumping straight to PPE. Involve workers in the process — they often have the most practical insight into what is and is not feasible on the floor. A collaborative approach also increases buy-in and improves the likelihood that controls will be followed consistently.

Step 3: Document Your Decisions and Rationale

Document your decisions and the rationale behind them. When a higher-level control is not feasible, record why, and what compensating measures are in place. This creates accountability, supports regulatory compliance, and provides a clear record for audits and inspections.

Step 4: Review and Reassess Controls Regularly

Finally, review and reassess controls regularly. New equipment, process changes, and evolving regulations can all affect the adequacy of existing controls. The hierarchy of controls is not a one-time exercise — it is an ongoing commitment to continuous improvement.

Why the Hierarchy of Controls Matters More Than Ever

A Shift From Reactive to Proactive Safety

As workplaces become more complex and regulatory expectations continue to rise, the hierarchy of controls provides a clear, evidence-based framework for making better safety decisions. It shifts the focus from reactive incident management to proactive hazard reduction and gives safety leaders a structured way to prioritize resources and effort.

The Business Case for Getting It Right

Organizations that consistently apply the hierarchy of controls tend to see fewer injuries, lower workers' compensation costs, improved regulatory compliance, and stronger safety cultures overall. More importantly, they protect the people who show up to work every day trusting that their employer has done everything reasonably possible to keep them safe.

The hierarchy of controls is not just a compliance tool. It is a fundamental expression of what good safety leadership looks like in practice.

Hierarchy of Controls Frequently Asked Questions

What is the hierarchy of controls and why does it matter in workplace safety?

The hierarchy of controls is a systematic framework that ranks hazard control strategies from most to least effective. Developed by NIOSH and endorsed by OSHA, it guides safety professionals toward solutions that address the root cause of a hazard rather than simply managing its symptoms. The five levels — elimination, substitution, engineering controls, administrative controls, and PPE — are ranked in order of reliability and protection. The framework matters because not all control measures provide equal protection. PPE relies entirely on correct and consistent use by the worker, while elimination removes the hazard entirely regardless of human behavior. By working from the top of the hierarchy downward, organizations build safety programs that are proactive rather than reactive, reducing injuries and illnesses in a meaningful and sustainable way.

What is the difference between engineering controls and administrative controls?

Engineering controls involve physically modifying the work environment or equipment to reduce or eliminate exposure to a hazard. These changes are built into the process or workspace itself, meaning they protect workers without requiring any specific action on their part. Examples include machine guards, ventilation systems, noise enclosures, and interlocks. Administrative controls, by contrast, change how work is organized or performed rather than changing the physical hazard. Examples include job rotation schedules, safe work procedures, training programs, and permit-to-work systems. The key difference is reliability — engineering controls work continuously and independently of human behavior, while administrative controls depend entirely on workers following procedures correctly every time. This is why engineering controls are ranked higher in the hierarchy and are generally considered more effective as standalone measures.

Is PPE ever sufficient on its own as a hazard control measure?

In most situations, PPE alone is not considered sufficient as a standalone hazard control measure. Because it sits at the bottom of the hierarchy of controls, PPE is the least reliable option available. It does not reduce or remove the hazard — it only provides a barrier between the worker and the hazard if used correctly. The effectiveness of PPE depends on selecting the right type for the specific hazard, ensuring a proper fit, maintaining the equipment in good working condition, and achieving consistent use by every worker every time they are exposed. OSHA and NIOSH both emphasize that PPE should be used as a supplement to higher-level controls, not as a replacement for them. There are limited situations — such as emergency response or short-term tasks where engineering controls are not yet in place — where PPE may be the primary control temporarily, but a plan to implement more robust measures should always accompany that decision.

How should organizations decide which level of the hierarchy to apply?

The decision should always start at the top of the hierarchy and work downward. For every identified hazard, the first question should be whether it can be completely eliminated. If elimination is not feasible, can the hazardous material or process be substituted with something safer? If substitution is not possible, what engineering controls can be implemented to physically reduce exposure? Only after thoroughly evaluating these options should organizations move to administrative controls and PPE. In practice, feasibility is often influenced by technical limitations, cost, and operational constraints. When a higher-level control is not immediately achievable, a phased approach is appropriate — implement lower-level controls in the short term while working toward more effective solutions over time. The rationale for each decision should be documented, and controls should be reviewed regularly to ensure they remain adequate as conditions change.

Can multiple levels of the hierarchy be used at the same time?

Yes — and in many cases, using multiple levels of control simultaneously is not only acceptable but strongly recommended. This approach, often called "defense in depth," creates layered protection so that if one control fails, others are still in place to prevent harm. For example, a manufacturing facility dealing with chemical exposure might install local exhaust ventilation (engineering control), establish written handling safety procedures and require annual training (administrative controls), and require workers to wear chemical-resistant gloves and safety glasses (PPE). Each layer addresses the hazard from a different angle, reducing the overall probability and severity of exposure. The key principle is that lower-level controls should supplement higher-level ones, not replace them. Adding PPE on top of strong engineering controls makes sense. Relying on PPE while neglecting to explore engineering solutions does not. A well-designed safety program uses the hierarchy to guide the prioritization of resources while building multiple layers of protection wherever feasible.