Hierarchy of control
Also known as: Hierarchy of risk control, General principles of prevention
The hierarchy of control is the order in which risk controls should be considered, from eliminating the hazard down to relying on PPE.
- A ranked order for choosing controls, strongest first.
- Eliminate, substitute, engineer, administrate, then PPE.
- PPE is last because it protects one person, and only while worn correctly.
The hierarchy of control is the order in which you should consider ways of controlling a risk. It runs from the most effective to the least, and the point of working down it in order is that the strongest options get considered before the weakest ones are settled for.
It is not a menu. It is a sequence, and the reason it appears in schedule 1 of the Management of Health and Safety at Work Regulations 1999 is that people otherwise reach for the easiest control rather than the best one.
The order
Eliminate. Remove the hazard entirely. Design out the work at height, prefabricate at ground level, order material cut to size so nobody cuts it on site.
Substitute. Replace it with something less harmful. A water-based product instead of a solvent, a smaller unit that does not need a lift, a method that does not create silica dust.
Engineering controls. Physically separate people from the hazard. Edge protection, guarding, extraction, suppression, barriers. These work whether or not anyone is paying attention, which is what makes them strong.
Administrative controls. Change how the work is organised. Permits, sequencing, exclusion zones, training, supervision, toolbox talks. These depend on people following them every time.
PPE. Equipment worn by the individual. Last, because it protects only the wearer, only while worn, and only if it fits and is maintained.
Using it properly
The hierarchy is how controls get chosen inside a risk assessment, so it belongs in the RAMS rather than sitting apart from them. When an assessment lists gloves and goggles against a dust hazard and nothing else, what it usually shows is that the four options above PPE were never tested.
It applies just as directly to COSHH, where extraction and suppression sit well above respiratory protection, and to work at height, where the regulations set out their own version of the same logic: avoid the work, prevent the fall, then minimise the distance and consequences.
The useful discipline is recording what you rejected and why. An assessment showing that elimination and substitution were considered and were not reasonably practicable is far more defensible than one that arrives at PPE with no working shown. Keeping that reasoning against the job, where it can be found later, is what Sync’s risk management is for.
Common questions
Why is PPE last?
Because it does the least. Every control above it removes or reduces the hazard for everyone nearby, permanently, whether or not anyone remembers to do something. PPE protects one person, only while it is worn, only if it fits, and only if it has been maintained. It is a last line of defence rather than a control plan.
Can I skip straight to PPE if the other options are expensive?
Cost alone is not a reason. The test in law is whether a control is reasonably practicable, which weighs the risk against the time, cost and effort of controlling it. A high risk needs a strong justification before you settle for the weakest control, and an inspector will ask what you considered first.
What counts as an engineering control?
Anything physical that separates people from the hazard without depending on behaviour. Edge protection, guarding, local exhaust ventilation, water suppression on a cutting saw, a barrier between plant and pedestrians.
Where does training sit?
Training, supervision, permits and signage are administrative controls, second from bottom. They rely on people doing the right thing every time, which is why they sit below controls that work regardless.
More Health & Safety terms
All 14 in this categoryKeep the paperwork where the work is
Sync keeps your health and safety records against the projects they belong to, with review dates tracked, so the current version is there when someone asks for it.