The hierarchy of controls is a framework that ranks ways of reducing workplace hazards from most to least effective: elimination, substitution, engineering controls, administrative controls and PPE.
The hierarchy of controls is a framework for choosing how to reduce or remove workplace hazards, ranking the available methods from most effective to least effective. In its most widely used form, promoted by NIOSH, the five levels are elimination, substitution, engineering controls, administrative controls and personal protective equipment (PPE). It is usually drawn as an inverted triangle, with the most effective controls at the wide top and the least effective at the narrow bottom.
The logic is simple. Controls at the top act on the hazard itself and protect everyone without relying on anyone doing the right thing. Controls at the bottom act on the person, protect only the individual using them, and fail as soon as someone forgets, takes a shortcut or uses the equipment incorrectly. The framework pushes safety decisions upward, so that teams ask "can we get rid of this hazard?" before asking "what should people wear?"
The hierarchy appears throughout safety management systems and standards. ANSI/ASSP Z10 and ISO 45001 both require organizations to apply it when selecting controls, and OSHA's Recommended Practices for Safety and Health Programs direct employers to use it when deciding how to address identified hazards.
Elimination physically removes the hazard so it no longer exists. Examples include designing a roof-mounted unit so it can be serviced from the ground, removing an unnecessary ladder task by relocating a valve, or stopping the use of a chemical that is no longer needed. Elimination is most practical at the design stage, which is why "prevention through design" is so closely linked to the hierarchy. Once a building, process or machine exists, eliminating a hazard often becomes costly or impossible.
Substitution replaces the hazard with something less dangerous. A water-based degreaser replacing a solvent with a low flash point, a smaller, lighter bag of material replacing a heavy one, or a battery-powered tool replacing a gasoline engine in an enclosed area are all substitutions. The key caution is to make sure the substitute does not introduce a new hazard that is just as bad, or worse, which requires checking its safety data sheet and how it will be used.
Engineering controls isolate people from the hazard by physical means. They include machine guards, interlocks, local exhaust ventilation, enclosures around noisy equipment, guardrails, lift assists and conveyors. Because they are built into the workplace, engineering controls work whether or not workers remember a rule. Their effectiveness depends on proper design, installation and maintenance; a ventilation hood with a clogged filter or a bypassed interlock offers little protection.
Administrative controls change the way people work. They include written procedures, permit-to-work systems, training, warning signs, job rotation, scheduling heavy tasks for cooler hours, limiting the number of people in an area, and inspection programs. They are often the quickest controls to put in place, but they depend on consistent human behavior and supervision, which makes them less reliable than physical controls.
PPE, such as hard hats, safety glasses, gloves, respirators, hearing protection and fall arrest harnesses, is the last line of defense. It does not reduce the hazard at all; it only places a barrier between the hazard and one person. PPE fails if it is the wrong type, poorly fitted, damaged, uncomfortable enough that people take it off, or simply not worn. It remains essential, especially where higher controls are not feasible or while they are being installed, but it should not be the only answer to a significant hazard.
For each significant hazard, start at the top and ask whether each level is feasible before moving down. Document why higher-level controls were rejected. That record shows auditors and regulators that the decision was deliberate, and it keeps the question open for future reviews when technology or budgets change.
Most real situations use several levels together. Welding fume might be reduced by substituting a lower-fume process, captured with local exhaust ventilation, limited by scheduling, and finally addressed with a respirator for the remaining exposure. Each layer reduces the burden on the ones below it.
A control is only useful if it can be implemented and sustained. A theoretically ideal engineering control that the maintenance team cannot keep working will fail. Every proposed control should also be checked for the new hazards it might create, such as a guard that makes cleaning harder and tempts workers to remove it.
The hierarchy also applies to ergonomic and psychosocial hazards. For fatigue, eliminating unnecessary night work or redesigning shift patterns sits higher than telling workers to take more breaks, which sits higher than issuing caffeine.
A furniture manufacturer had recurring complaints of headaches and dizziness in its finishing department, where workers hand-sprayed a solvent-based lacquer. Air monitoring confirmed solvent vapor exposures near the permissible limit. The initial proposal from the supervisor was to issue half-face respirators to all sprayers.
The safety team walked the hierarchy instead. Elimination was not possible because the product needed a finish. For substitution, the company trialed a waterborne lacquer, which met quality requirements for most product lines and cut solvent use in the department by about 70%. For engineering controls, it upgraded the spray booth's exhaust, added a filter-change schedule and installed a pressure gauge so operators could see when airflow dropped. Administratively, spraying of the remaining solvent-based products was limited to one booth with written procedures. Respirators were kept for that booth only. Follow-up monitoring showed exposures well under the limit, and the complaints stopped. The decisions were documented and logged as a corrective action.
Because it does nothing to the hazard and depends entirely on the individual. If the PPE is the wrong type, fits poorly, is damaged or is not worn, protection is lost immediately and without warning. Higher controls protect everyone in the area and keep working even when people make mistakes.
Several OSHA standards build it in. For example, standards for noise and many air contaminants require feasible engineering and administrative controls before relying on PPE. ISO 45001 and ANSI/ASSP Z10 also require organizations to apply it. Even where no specific standard applies, it is the accepted method for showing that controls were chosen reasonably.
Engineering controls physically change the workplace or equipment to separate people from a hazard, such as a guard or an exhaust hood. Administrative controls change how people work, such as a procedure, a schedule or a training requirement. Engineering controls are generally more reliable because they do not depend on behavior.
Sometimes, especially with elimination, which removes the hazard entirely. In most cases, though, a combination of levels gives the best protection, with higher controls reducing the hazard as far as feasible and lower controls managing what remains.
Part of SafetyIQ's EHS glossary: plain-English definitions of workplace health and safety terms.
> Keep learning
> See it in action
Capture hazards, run inspections, track training and close out corrective actions in one platform built for high-risk, field-heavy work.
Book my free demo
Get a demo built around your sites, your teams, and the way your people work.
EHS, journey, and fatigue management software for field-heavy teams.
.png){kind=logo}
.png)