Regulations 32–38: WHS Hierarchy of Controls

Regulatory citation: Model Work Health and Safety Regulations, Part 3.1 (Regulations 32–38)

What Do Regulations 32–38 Require?

Part 3.1 of the model Work Health and Safety Regulations sets out a standard process for managing risks to health and safety. It applies whenever another part of the regulations requires a duty holder to manage risks, and it underpins the general approach expected across all WHS duties.

Why This Part Matters

These regulations turn the general duty to ensure safety "so far as is reasonably practicable" into a clear process: find the hazards, control them using the most effective measures available, keep the controls working and check they remain effective.

Core Obligations

1. Identify Hazards (Regulation 34)

Duty holders must identify reasonably foreseeable hazards that could give rise to risks to health and safety.

2. Eliminate or Minimize Risks (Regulation 35)

Risks must be eliminated so far as is reasonably practicable. If that is not reasonably practicable, they must be minimized so far as is reasonably practicable.

3. Apply the Hierarchy of Controls (Regulation 36)

Where a risk cannot be eliminated, it must be minimized by implementing risk control measures in the following order:

• Substitution: replacing the hazard with something that gives rise to a lesser risk
• Isolation: isolating the hazard from people
• Engineering controls: physical controls such as guarding or ventilation
• Administrative controls: procedures, training and signage, if a risk remains
• Personal protective equipment (PPE): if a risk still remains

A combination of controls may be used. Higher-order controls are more reliable because they do not depend on people's behavior.

4. Maintain Control Measures (Regulation 37)

Control measures must be maintained so they remain effective, including being fit for purpose, suitable for the nature and duration of the work, and installed, set up and used correctly.

5. Review Control Measures (Regulation 38)

Controls must be reviewed and, if necessary, revised, including when a control does not work as intended, before a change at the workplace that may create a new risk, when a new hazard or risk is identified, when consultation indicates a review is needed, or when an HSR requests a review.

Common Compliance Approaches

Risk Assessments and Registers

Use a consistent risk assessment method and keep a risk register that records hazards, controls, owners and review dates.

Design Out Hazards Early

The cheapest time to eliminate a hazard is during design, purchasing or planning, before it reaches the workplace.

Scheduled Reviews and Inspections

Build control checks into inspections and audits so failed or degraded controls are found and fixed quickly.

Example: The Hierarchy of Controls in Practice

A cabinet maker identifies wood dust as a health risk. Eliminating cutting isn't possible, so the business substitutes pre-finished panels for some jobs, installs local exhaust ventilation on saws and sanders (an engineering control), introduces wet cleaning instead of dry sweeping (an administrative control) and provides fitted respirators for remaining high-dust tasks. The ventilation system is tested regularly and the controls are reviewed when new machinery is purchased.

Note: This summary is based on the model WHS laws published by Safe Work Australia. Most states and territories have adopted them with minor variations, while Victoria has its own OHS laws. Always check the legislation and codes of practice that apply in your jurisdiction.

Frequently Asked Questions

What is the hierarchy of controls under WHS law?

The hierarchy of controls ranks risk control measures from most to least effective. Duty holders must first try to eliminate the risk. If that isn't reasonably practicable, they must minimize it through substitution, isolation or engineering controls, then administrative controls, then personal protective equipment, in that order.

Is PPE enough to control a risk?

Usually not on its own. PPE is the lowest level of the hierarchy because it relies on correct fit, use and maintenance by each person. It should be used only when higher-order controls are not reasonably practicable or to manage a remaining risk.

When must control measures be reviewed?

Controls must be reviewed when they don't work as intended, before workplace changes that may create new risks, when new hazards are identified, when consultation shows a review is needed, and when an HSR requests one. Many businesses also schedule routine reviews.