How to Use the Hierarchy of Controls

What the Hierarchy of Controls Is and Why It Works

Every hazard assessment ends with the same question: what are we going to do about it? The hierarchy of controls is how you answer that question well. It ranks the ways of controlling a hazard from the most effective to the least effective, so the choice isn't left to habit, budget or whatever is quickest.

There are five levels, from top to bottom:

• Elimination. Remove the hazard completely, so nobody can be exposed to it. Do the work at ground level instead of at height, or design out the task that needed the ladder.
• Substitution. Replace the hazard with something less hazardous: a water-based product instead of a solvent, a lighter bag instead of a heavy one, a quieter machine instead of a loud one.
• Engineering controls. Separate people from the hazard by changing the equipment or the workplace: machine guards, local exhaust ventilation, guardrails, noise enclosures, interlocks and physical barriers.
• Administrative controls. Change how people do the work: safe work procedures, permits, training, signs, scheduling, job rotation and supervision.
• Personal protective equipment. Put a barrier on the person: hearing protection, respirators, gloves, eye and face protection, fall arrest and high-visibility clothing.

The order isn't arbitrary. Controls at the top work on the hazard itself and keep working whether or not anyone remembers them. Controls at the bottom work on people, so they depend on everyone doing the right thing every time. The US National Institute for Occupational Safety and Health explains the hierarchy in those terms: elimination, substitution and engineering controls are more effective because they control exposures without significant human interaction, while administrative controls and PPE need significant and ongoing effort from workers and their supervisors.

You'll see the hierarchy drawn as a pyramid, an inverted triangle or a list, and some versions combine elimination and substitution or leave substitution out. The idea is the same in all of them. Think of the hierarchy as a sequence of questions you work through, not a menu you pick from. Can we get rid of the hazard? If not, can we swap it for something less hazardous? If not, can we keep it away from people? Only after those questions have honest answers do procedures and PPE become the main defence.

The law points the same way, and several Canadian jurisdictions write the order into their rules. Alberta's Occupational Health and Safety Code requires employers to eliminate a hazard or, if elimination isn't reasonably practicable, to control it with engineering controls first, then administrative controls that bring it as low as reasonably achievable, then PPE. A combination is allowed where it gives workers a greater level of safety.

British Columbia and federally regulated workplaces have similar rules, covered below where they matter, and ISO 45001, adopted in Canada as CSA Z45001, builds the hierarchy into its requirements. Every other province and territory expects employers to eliminate or control the hazards they find. Our OHS Legislation in Canada page links to the rules for each jurisdiction.

The hierarchy applies to every kind of hazard, not just machinery and chemicals. Noise, falls, mobile equipment, ergonomic strain, temperature extremes, biological hazards, fatigue and workplace violence can all be controlled with the same sequence, and the best results usually come from controls at more than one level working together.

Who's Involved in Choosing Controls

Choosing controls isn't a job for the safety coordinator alone. The best controls come from the people who know the work, the equipment and the budget.

• Owners and managers. They decide what gets bought, redesigned or scheduled, so they decide whether the higher-level controls happen at all. They also set the expectation that "we'll just give them PPE" isn't the default answer.
• Supervisors. They know how the work is really done, they make sure controls are in place before work starts, and they're the first to notice when a control stops working or is being bypassed.
• Workers who do the task. They often know the simplest way to remove a hazard, and they'll quickly tell you whether a control gets in the way of the work. A control that workers find awkward is a control that gets defeated. In Alberta, involving affected workers in controlling hazards is a legal requirement.
• The joint health and safety committee or representative. They can review proposed controls, raise concerns and check whether controls are working during inspections.
• Purchasing, engineering and maintenance. The cheapest time to eliminate a hazard is before it arrives. Buying a quieter machine, specifying a guard or designing a platform into a new installation is far easier than retrofitting later. Maintenance keeps engineering controls working.
• Contractors and suppliers. They may know safer products, methods or equipment, and on shared sites their controls and yours have to work together.

How to Use the Hierarchy of Controls, Step by Step

Using the hierarchy well is a short, disciplined process. Define the hazard, rate the risk before any controls, work down the levels from the top, decide what's reasonably practicable, combine controls where one isn't enough, rate the residual risk, and then verify that the controls work and keep working. Our free control selection worksheet follows the same steps, and the sections below explain the judgement calls at each one.

Define the Hazard and Rate the Initial Risk First

You can't pick the right control for a vague hazard. "Chemicals" or "noise" doesn't tell you what to control. "Solvent vapour from hand-wiping parts in an open tray, about two hours a shift" or "grinding noise above 90 dBA at the fabrication bench" does. Write the hazard as a specific statement of what could go wrong, for whom, during which task.

It helps to name the energy behind the hazard. Uncontrolled energy is what hurts people: gravity, motion, mechanical, electrical, pressure, temperature, radiation, sound, chemical, biological, ergonomic and psychosocial. Controls work by removing the energy, reducing it or keeping it away from people, so knowing the energy points you toward the right kind of control.

Then rate the initial risk before you consider any controls. Initial risk always comes before controls. It tells you how much work the controls have to do and how high up the hierarchy you need to reach. A hazard that could kill or permanently injure someone needs controls that don't rely on people remembering, no matter how unlikely it seems. Use the same risk method as your JHAs. Our worksheet uses a five-by-five matrix that multiplies likelihood by severity for a score from 1 to 25.

Start at the Top: Elimination and Substitution

Always ask the elimination question first, even when you're sure the answer is no. It's surprising how often it isn't. Do we need to do this task at all? Could it be done somewhere else, at another time or in another way that removes the hazard?

• Assemble components on the ground and lift them into place, instead of assembling them at height.
• Have parts delivered clean, cut to size or pre-finished, so the cleaning, cutting or painting doesn't happen in your shop.
• Use remote monitoring or a camera instead of sending someone into a confined space to check a level.
• Remove a tripping hazard, a sharp edge or an unused piece of equipment instead of marking it.

If the hazard can't be removed, look for a substitute: something that does the same job with less hazard. Water-based products in place of solvent-based ones, a different abrasive instead of silica sand, smaller containers, lighter packaging, a battery tool instead of a gas-powered one indoors. Substitution can also mean a different process, such as clamping instead of welding or wet cutting instead of dry cutting.

Check the substitute before you switch. A less flammable product may be more toxic, and a water-based cleaner may be corrosive to skin. Read the safety data sheet, compare the hazards and make sure the overall risk really goes down. British Columbia's Occupational Health and Safety Regulation makes this explicit: the hazards of a substitute must be known and the risk to workers reduced by using it. For carcinogens, reproductive toxins and sensitizers, the same Regulation requires employers to replace the substance with a less hazardous material wherever it's practicable.

The best time for elimination and substitution is before the hazard arrives: when you plan a job, design a work area, write a purchasing specification or choose a contractor. NIOSH calls this Prevention through Design. Building controls into new equipment and spaces costs far less than retrofitting them later.

Engineering Controls: Separate People From the Hazard

If the hazard has to stay, engineering controls are the next choice. They change the equipment, the process or the workplace so the hazard is contained or people are physically separated from it. Good engineering controls work automatically, every shift, without anyone having to remember them.

• Guarding and interlocks that stop people reaching moving parts, or stop the machine when a guard is opened.
• Local exhaust ventilation that captures fume, dust or vapour at the source, before it reaches the worker's breathing zone.
• Guardrails, covers and travel restraint anchors that prevent falls instead of arresting them.
• Enclosures, barriers and isolation: a noise enclosure around a compressor, a physical barrier between pedestrians and forklifts, a remote control booth.
• Mechanical aids: lift tables, hoists, vacuum lifters and conveyors that take the load off people's backs.

Engineering controls need care to keep working. Ventilation loses capture when filters clog or ducts are damaged, interlocks get bypassed, and guards are removed for maintenance and not put back. Build inspection, testing and maintenance into your program from the day the control is installed. The Canada Occupational Health and Safety Regulations require federally regulated employers to have a preventive maintenance program for exactly this reason, and auditors look for one.

Watch for new hazards, too. An enclosure can create a confined space, a guard can create a pinch point, and a mechanical aid can tip over if it's used on uneven ground. A control that creates a new hazard needs its own assessment.

Administrative Controls: Change How the Work Is Done

Administrative controls change how people work rather than changing the hazard. They include safe work procedures, permits to work, lockout procedures, training, signs and labels, inspection schedules, exclusion zones, limits on how long someone is exposed, job rotation, rest breaks, working-alone check-ins and supervision.

They're essential, and almost every hazard needs some. A lockout procedure, a hot work permit or a confined space entry plan is what makes the higher-level controls work in practice. But on their own, administrative controls are weaker than they look, because they depend on people knowing the rule, remembering it and following it under time pressure, fatigue and distraction, every time.

Some administrative controls are stronger than others. A procedure that's written for the actual task, trained, practised and checked by a supervisor is far more reliable than a sign on the wall. "Be careful," "use caution" and "stay alert" aren't controls at all. If your JHA lists awareness as the main control for a hazard that could seriously injure someone, go back up the hierarchy.

Not every jurisdiction ranks administrative controls the same way. The federal regulations list elimination, including engineering controls, first, then reducing the hazard, including by isolating it, then PPE, then administrative procedures such as managing exposure and recovery periods. Alberta, British Columbia and most guidance place administrative controls above PPE. Either way, both sit below the controls that act on the hazard itself.

Training deserves a special mention. It's an administrative control, and it's necessary, but it doesn't control a hazard by itself. Training tells people how to use the controls; it doesn't remove the hazard. When an incident investigation ends with "retrain the worker," ask whether a higher-level control was available and missed.

PPE: The Last Line of Defence, Done Properly

PPE is at the bottom of the hierarchy because it doesn't change the hazard at all. The hazard is still there, at full strength, and the only thing between it and the worker is a piece of equipment that has to be the right type, fit properly, be in good condition and be worn correctly for the whole exposure. If any one of those fails, the worker is unprotected, often without knowing it.

That doesn't make PPE unimportant. It's often required as an added layer, for example safety glasses and gloves alongside a guard, or as the main protection for short, temporary or emergency work where higher controls aren't practicable. When you rely on PPE, run it as a program, not a purchase:

• Select it for the hazard, using the safety data sheet, the manufacturer's information and the applicable standards.
• Fit it to the person, including fit testing for tight-fitting respirators.
• Train people on how to use it, its limitations and how to inspect and care for it.
• Maintain and replace it, with clear rules for cleaning, storage, filters, cartridges and damaged equipment.
• Supervise its use, because PPE that isn't worn, or is worn wrong, protects nobody.

British Columbia sets clear limits. Under its regulation, PPE can be the primary control for a hazardous substance only when the other controls aren't practicable, when extra protection is needed because they aren't enough, or when the exposure comes from temporary or emergency conditions. The PPE Part of the same Regulation applies the same order to head protection: eliminate the risk or, if that isn't practicable, use engineering controls, then administrative controls, then safety headgear.

PPE can also create hazards of its own: heat stress under protective suits, reduced hearing of alarms under earmuffs, reduced vision in goggles and extra strain from heavy respirators. Energy Safety Canada's hierarchy of controls guide sums it up: using PPE as the main way to control exposures should be limited to situations where elimination, substitution, engineering and administrative controls aren't practicable or possible. Our post on why PPE should be the last line of defence explains how over-reliance on PPE shows up in audits and investigations.

Combine Controls and Decide What's Reasonably Practicable

Most hazards need more than one control. A grinder might have a guard (engineering), a procedure for changing discs and a rule about who can use it (administrative), and face shields and hearing protection (PPE). WorkSafeBC's guidance puts it simply: all four types of controls should be considered, and they often work best in combination. Layering controls means that when one fails, another is still there.

The key is to build the combination from the top down. Use the highest controls that are reasonably practicable, then add lower-level controls to deal with what's left. Don't let an easy lower-level control stop you looking higher. Alberta's Code allows a combination of controls where it gives a greater level of worker safety, which is a high bar, not a shortcut.

Deciding what's reasonably practicable is a judgement, and you should be able to explain it. Our post on what reasonably practicable means explains how regulators and courts look at it. In short, consider:

• how severe the harm could be and how likely it is;
• what's known about the hazard and the ways to control it;
• whether a control is available and suitable for the work;
• whether the cost and effort are reasonable compared with the risk.

Cost counts, but it isn't a trump card. A control is generally expected unless its cost is clearly out of proportion to the risk it reduces, and the more serious the hazard, the more you're expected to spend. "It's expensive" isn't the same as "it isn't reasonably practicable." Many effective controls cost very little: WorkSafeBC's own example is a mirror on a blind corner.

Record your reasoning. If a higher-level control was considered and rejected, write down why. Our control selection worksheet has a line at each level for the options you considered and whether each one is reasonably practicable. That record is your evidence of due diligence, and it's what a regulator or auditor will ask for.

Check the Residual Risk and Any New Hazards

Once you've chosen the controls, rate the risk again as though they're in place. This residual risk tells you whether the controls are enough. If it's still high, the work shouldn't go ahead as planned. Go back up the hierarchy, add controls or change the job. If it's low or moderate and as low as reasonably achievable, record it and move on to putting the controls in place.

Ask one more question before you finish: does any control create a new hazard? A substitute chemical with a different hazard, a guard that creates a pinch point, a barrier that blocks an emergency exit, a respirator that adds heat stress, an extra procedure that pushes people to rush. The federal regulations say a preventive measure must not itself create a hazard, and that's good practice anywhere. Assess any new hazard the same way and adjust the controls.

Verify That Controls Work and Keep Working

A control on paper isn't a control. Before work starts, confirm that each control is actually in place: the guard is installed, the ventilation is running, the barrier is up, the procedure has been trained, the PPE fits. Then keep checking, because controls drift. Guards get removed and not replaced, filters clog, procedures get shortcut, and PPE wears out.

• Inspect controls during workplace inspections, not just the hazards. Our post on inspections that find hazards but never eliminate them explains why that matters.
• Monitor where you can measure: noise levels, air sampling, ventilation flow, lighting.
• Maintain engineering controls on a schedule, with records.
• Watch the work. Supervisors and the joint committee should observe whether controls are used as intended and ask workers whether they get in the way.
• Review controls when things change, after an incident or near miss, and when monitoring or inspections show a problem.

For the hazards that could kill or seriously injure someone, identify the critical controls, the few controls that must work every time, and verify them more often. A short critical control check at the start of the shift, built into your field-level hazard assessment, catches a missing control before anyone is exposed.

The Hierarchy Works for Health, Ergonomic and Psychosocial Hazards Too

The hierarchy is often taught with machines and chemicals, but it applies just as well to hazards that build up over time or come from how work is organized.

Ergonomic hazards. Eliminate the lift by delivering materials to the point of use at waist height. Substitute lighter containers. Use lift tables, hoists, adjustable workstations and conveyors as engineering controls. Use job rotation, micro-breaks and training on safe handling as administrative controls. PPE plays a very small part, such as knee pads for floor work. The federal regulations specifically apply their order of priority to ergonomics-related hazards.

Psychosocial hazards and workplace violence. The highest controls come from how work and workplaces are designed: realistic workloads and staffing, a reception area designed with a barrier and a clear exit, cash handling that removes the reason for a robbery. Administrative controls include procedures, working-alone check-ins, training in de-escalation and clear reporting. PPE rarely applies, which is a good reminder that the hierarchy is about design first.

Heat, cold and fatigue. Schedule hot work for cooler hours, provide shade, cooling or heated shelters, mechanize heavy work, limit shift lengths and plan rest. Clothing and PPE are part of the answer, not the whole of it.

Use the Hierarchy in JHAs, FLHAs and Investigations

The hierarchy shouldn't live in a single training slide. It's the reasoning behind every control decision in your safety program.

• Job hazard analyses. Each hazard in a job hazard analysis should show the initial risk, the controls chosen using the hierarchy and the residual risk. Our JHA template includes a hierarchy of controls reference for exactly this.
• Field-level hazard assessments. In the field, high-level controls often look simple: moving the work out of a traffic lane, closing a path, using a different tool or rescheduling until the weather clears.
• Incident investigations. Strong corrective actions sit high in the hierarchy. If every investigation ends with retraining or a reminder, the same incident will happen again. Our post on corrective actions that are never properly closed explains how to follow them through.
• Planning, purchasing and change. Ask the elimination and substitution questions whenever you buy equipment or chemicals, plan a new job, renovate a space or change a process.

Common Hierarchy of Controls Mistakes to Avoid

• Jumping straight to PPE or training. They're the easiest controls to write down and the weakest on their own. Ask the elimination, substitution and engineering questions first, every time.
• Treating the hierarchy as a menu. Picking the most convenient control from any level misses the point. Work from the top and record why higher levels weren't reasonably practicable.
• Listing awareness as a control. "Be careful," "stay alert" and "watch for traffic" don't control anything, especially for hazards that could kill or seriously injure someone.
• Rating risk only after the controls. Without an initial risk rating, you can't show how much the controls reduced the risk or whether they're enough.
• Ignoring new hazards created by controls. Substitutes, guards, barriers and PPE can all introduce hazards of their own.
• Installing engineering controls and forgetting them. Without inspection and maintenance, ventilation, guards and interlocks quietly stop working.
• Using cost as an automatic veto. A control is generally expected unless its cost is clearly out of proportion to the risk. Many good controls are cheap.
• Choosing controls without the workers. Controls that get in the way of the work get bypassed. The people who do the task often know the best solution.

Download the Quick Guide and Control Selection Worksheet

Two free downloads go with this guide.

• Hierarchy of Controls Quick Guide (PDF). A two-page summary of the five levels with examples, and clickable checklists for choosing controls, checking residual risk and verifying that controls work.
• Control Selection Worksheet (PDF). A landscape worksheet with clickable checkboxes for working one hazard through the hierarchy: the hazard and its energy source, the initial risk before controls, the options considered at each level and whether each is reasonably practicable, the controls selected, new hazards created, the residual risk, verification and sign-off, with a five-by-five risk matrix reference.

Click either button to download the PDF. Adapt the worksheet to your operation and the law where you work, and if your organization already has an approved risk method, use it in place of the generic matrix.

About the author

John Duplessis, B.Sc., CRSP

President and Principal Health & Safety Consultant

John Duplessis is a Canadian Registered Safety Professional with more than 30 years of occupational health and safety experience in oil and gas, construction, green energy, midstream operations and industrial project work.

Meet our team