Hierarchy of Controls: 5 Levels With Worked Examples

The hierarchy of controls is a ranked order for choosing risk controls: eliminate the hazard, substitute it with something less dangerous, isolate people with engineering controls, change how people work with administrative controls, and only then rely on personal protective equipment (PPE). Higher levels work without depending on each worker's behavior, so they protect more reliably.

Almost every safety professional can recite the five levels. The harder part is using them when the easy answer is a box of gloves and a signature on a toolbox talk sheet. Risk assessments across many industries still end with "wear PPE" and "be careful" in the control column, because those controls are cheap, fast and visible.

This guide takes the hierarchy past the pyramid picture. You will see five common hazards worked through all five levels, a decision table for the moment someone proposes PPE as the main control, a scored comparison of two control plans, and what the hierarchy looks like in OSHA rules, ISO 45001, EU law and Turkish law.

---

Two Plans for the Same Roof Edge

Picture a hypothetical facilities team. A rooftop air-handling unit sits a few meters from an unprotected roof edge, and a technician services it every month. Two people write the control plan.

The first writes: "Technician wears a full-body harness and lanyard. Toolbox talk before each visit." The plan costs little and can start tomorrow.

The second writes: "Install a permanent guardrail along the edge nearest the unit. Until it is installed, use a harness with a certified anchor point and a written rescue plan. Longer term, specify units that can be serviced from the ground when the equipment is replaced."

Both plans mention a harness. Only the second one would still protect the technician on the day they forget to clip on, the day the anchor is missing, or the day a contractor who never attended the toolbox talk goes up instead. That difference is what the hierarchy of controls is about. The scenario is illustrative, and we score both plans later in this guide.

---

What Is the Hierarchy of Controls?

The hierarchy of controls is a framework that ranks risk control measures from most to least effective, so that you consider the strongest option first and only move down when a higher level is not practicable. The National Institute for Occupational Safety and Health (NIOSH) lists five levels: elimination, substitution, engineering controls, administrative controls and PPE. NIOSH explains that elimination, substitution and engineering controls "are more effective because they control exposures without significant human interaction."

The same order appears in regulations and standards across jurisdictions, under slightly different names:

Source	How it states the hierarchy
NIOSH	Elimination → substitution → engineering controls → administrative controls → PPE
OSHA Recommended Practices	Engineering solutions (including elimination or substitution) first, then safe work practices and administrative controls, and finally PPE
ISO 45001:2018, Clause 8.1.2	Eliminate the hazard → substitute → engineering controls and reorganization of work → administrative controls, including training → adequate PPE
EU Framework Directive 89/391/EEC, Art. 6(2)	Avoid risks, combat risks at source, replace the dangerous with the less dangerous, give collective protective measures priority over individual ones
UK HSE	PPE "should be the last resort", after elimination, substitution, engineering and administrative controls
Türkiye	6331 sayılı Kanun Madde 5 (risklerden korunma ilkeleri) and the Risk Değerlendirmesi Yönetmeliği Madde 10

The hierarchy is also called the hierarchy of control measures, the risk control hierarchy or the hierarchy of hazard controls. It is not a separate risk assessment method. It is the rule you apply in the "controls" step of any method, from a simple risk assessment to Fine-Kinney or HAZOP.

---

The Five Levels Explained

1. Elimination

Elimination removes the hazard at its source, so no one can be exposed to it. NIOSH defines it simply: "Elimination removes the hazard at the source." Examples: doing the work at ground level instead of at height, buying pre-cut material so no one cuts it on site, or removing a task entirely. Elimination is easiest and cheapest at the design and purchasing stage, and hardest once a process is running.

2. Substitution

Substitution replaces the hazard with something less dangerous. NIOSH's example is using plant-based printing inks instead of solvent-based inks. Other examples: a water-based cleaner instead of a solvent, a lower-voltage tool, or a smaller container of a hazardous chemical. The hazard is reduced, not gone, so check that the substitute does not bring a new hazard of its own.

3. Engineering Controls

Engineering controls isolate people from the hazard with a physical change to the workplace, equipment or process. NIOSH says they "reduce or prevent hazards from coming into contact with workers." Guardrails, machine guards, interlocks, local exhaust ventilation, noise enclosures and physical barriers between forklifts and pedestrians are all engineering controls. Once installed, they work whether or not the worker remembers them.

4. Administrative Controls

Administrative controls change the way people work. In NIOSH's words, they "establish work practices that reduce the duration, frequency, or intensity of exposure to hazards." Procedures, permits, training, signage, job rotation, supervision and restricting access all sit here. They depend on people following them every time, which is why they rank below engineering controls. A permit to work and lockout/tagout procedures are administrative controls that manage high-energy work.

5. Personal Protective Equipment

PPE is equipment worn to reduce exposure: gloves, safety glasses, hearing protection, hard hats, respirators, fall arrest harnesses. It is the last line of defense. It protects only the person wearing it, only when it is the right type, fitted and worn correctly, and only while it works. When PPE fails, it often fails silently.

---

Worked Examples: 5 Hazards Through All 5 Levels

Most guides give one example per level, each from a different hazard. On a real site you work the other way: you take one hazard and ask what each level could do about it. The table below does that for five common hazards. The options are illustrative. Which ones are practicable depends on your site, and a good control plan usually combines several levels.

Hazard	Elimination	Substitution	Engineering	Administrative	PPE
Fall from a flat roof edge during monthly HVAC servicing	Specify equipment that can be serviced or monitored from the ground	Use a mobile elevating work platform with guardrails instead of a ladder and walking to the edge	Permanent guardrail along the edge; fixed access with a self-closing gate	Access only under permit; named, trained technicians; rescue plan	Full-body harness on a certified anchor, used while the guardrail is not in place
Silica dust from cutting concrete with a handheld saw	Design openings into the concrete pour so no cutting is needed	Use a method that produces less dust, such as drilling and splitting instead of abrasive cutting	Saw with integrated water delivery to the blade; on-tool extraction with a HEPA vacuum	Keep others out of the cutting zone; limit task time; no dry sweeping	Respirator where the task and duration require it
Noise from a machine line above 90 dBA	Remove compressed-air blow-off steps from the process	Buy a quieter machine or quieter nozzles at replacement	Acoustic enclosure, damping, silencers; operator booth	Job rotation; quiet break area; noise-zone marking and access limits	Hearing protection selected for the measured noise level
Solvent vapor from manual parts degreasing	Change upstream processes so parts arrive without oil that needs removing	Water-based cleaner instead of a solvent	Lidded tank with local exhaust ventilation	Written procedure; SDS-based training; keep lids closed when not in use	Chemical-resistant gloves and goggles; respirator only if ventilation cannot control vapor
Forklift–pedestrian collision in a warehouse	Remove pedestrian routes from forklift aisles (for example, conveyors to picking stations)	Use lower-speed equipment in mixed areas	Physical barriers and separated walkways; speed limiters; interlocked gates at crossings	One-way traffic plan; marked crossings; operator training and refreshers	High-visibility clothing

Three patterns stand out in the table:

1. Elimination usually lives upstream. Almost every elimination option is a design or purchasing decision. If your risk assessment only happens on the shop floor, you will rarely see it. Involve engineering and purchasing when equipment is specified.
2. Engineering controls do most of the work. In four of the five rows, the engineering control is the one that reduces risk regardless of who is working that day.
3. PPE is still there. The hierarchy does not remove PPE from the plan. It moves PPE to the bottom as a backup or for the risk left over after higher controls.

Some of these controls also appear in law. For silica, OSHA's construction standard 29 CFR 1926.1153 Table 1 specifies a handheld saw with an integrated water delivery system for this task. Respiratory protection is added only in some conditions: indoors or in enclosed areas, or outdoors for more than four hours per shift. The same standard bans dry sweeping where it could add to exposure, unless alternatives are infeasible. For chemical hazards in general, see our chemical safety guide. For traffic routes and racking, see the warehouse safety checklist.

---

Why PPE-First Plans Fail: A Decision Table

PPE-first plans fail because they make the whole control depend on one person doing the right thing every time, with equipment that has to be selected, fitted, maintained and replaced. Use this table when a draft risk assessment lists PPE as the main or only control.

What the PPE-first plan assumes	What happens in practice	What to ask instead
Everyone exposed will wear it	PPE protects only the wearer. Visitors, contractors and passers-by are often unprotected	Can a collective measure protect everyone in the area?
It will be worn every time, all the time	Heat, discomfort and rushed jobs lead to skipped use	Can an engineering control work without anyone's action?
It fits and is the right type	A respirator needs medical evaluation, fit testing at least annually and training under 29 CFR 1910.134	Is the PPE program cheaper than removing the exposure?
It still works	Filters load up, harnesses wear, hearing protection is worn incorrectly, and the failure is not visible	Who inspects it, how often, and where is the record?
It adds no risk of its own	PPE can restrict vision, hearing, movement or cooling, which can create new hazards	Does the PPE create a new hazard for this task?
The law allows it as the main control	Many rules require higher-level controls first (see below)	Have higher levels been considered and documented as not practicable?

The legal point is concrete. OSHA's respiratory protection standard says contamination must be prevented "as far as feasible by accepted engineering control measures," and respirators are used "when effective engineering controls are not feasible, or while they are being instituted" (29 CFR 1910.134(a)(1)). The noise standard, 29 CFR 1910.95(b)(1), requires "feasible administrative or engineering controls" above the Table G-16 limits (90 dBA for eight hours) and adds PPE only if those controls fail to bring levels within the table. In the EU, Directive 89/391/EEC Article 6(2)(h) gives collective protective measures priority over individual ones.

---

When Is PPE the Right Answer?

PPE is the right answer in three situations: as an interim measure while higher controls are being put in place, for the residual risk that remains after them, and for short, non-routine or emergency work where higher controls are genuinely not practicable.

• Interim. OSHA recommends "interim controls while you develop and implement longer-term solutions" (OSHA). The harness in the roof-edge example is exactly this: it protects the technician until the guardrail is installed. Write an end date on it.
• Residual. After engineering controls, some exposure may remain. In the silica example, Table 1 still requires a respirator for indoor cutting even with water delivery.
• Non-routine or emergency work. Rescue, spill response and one-off tasks can leave little room for higher controls. The PPE decision should still be deliberate and recorded, not a default.

In each case, the PPE is part of a combination. OSHA's guidance is to "use a combination of control options when no single method fully protects workers."

---

Scoring the Difference: Residual Risk Before and After

A risk score makes the hierarchy visible. Here are the two roof-edge plans from the opening scenario, scored with the Fine-Kinney scales used in our Fine-Kinney examples (Risk = Probability × Exposure × Consequence). The values are illustrative.

Condition	P	E	C	Risk	Class
No controls: technician walks near the unprotected edge	3 (unusual but possible)	2 (monthly)	15 (one fatality)	90	Substantial
Plan 1: harness and toolbox talk only, used correctly	3	2	7 (serious injury: arrested fall, suspension)	42	Possible
Plan 1 on the day the harness is not clipped on	3	2	15	90	Substantial
Plan 2: permanent guardrail installed	0.5 (conceivable but very unlikely)	2	15	15	Acceptable

Two things are worth noticing. First, the PPE-only plan reduces the score only if it is used correctly every time, so its real risk swings between 42 and 90 depending on behavior. Second, the guardrail lowers probability, not consequence, and does it for everyone on the roof. If the unit is later replaced with one serviced from the ground, the exposure to the edge disappears entirely.

Kinney and Wiruth's scales are relative, so use the scores to compare options inside one assessment rather than as absolute numbers. When no option gets the risk low enough, the ALARP principle helps you decide whether further controls are reasonably practicable.

---

How to Apply the Hierarchy in Your Risk Assessment

Apply the hierarchy by starting at the top for every significant hazard and writing down why each higher level was or was not used. A practical sequence:

1. Describe the hazard and the task precisely. "Working at height" is too vague. "Monthly filter change on AHU-3, 2 m from the north roof edge" gives you something to control.
2. Ask the elimination question first. Could the task be done without the hazard at all? Include design, purchasing and scheduling options.
3. Work down the levels. For each level, list at least one realistic option, even if you reject it.
4. Record why higher options were rejected. "Not practicable because…" with a cost, time or technical reason. This is your evidence for auditors and inspectors.
5. Combine controls. Pick the highest practicable level, then add lower levels for the residual risk.
6. Put owners and dates on every action. Turkey's Risk Değerlendirmesi Yönetmeliği Madde 10 requires control plans to name the responsible person and the start and end dates. It is good practice everywhere.
7. Re-score the residual risk. If the risk is still not acceptable, go back to step 3.
8. Verify the controls on site. A guardrail with a missing section or a ventilation hood with a blocked duct is not a control. Check it during inspections.

ISO 45001 Clause 8.1.2 asks organizations to have a process for eliminating hazards and reducing OH&S risks using this hierarchy, so the same records support certification audits.

---

Common Mistakes When Applying the Hierarchy of Controls

1. Writing "PPE" and "training" as the default controls

This happens when the controls column is filled in at a desk after the walk-through. It is dangerous because both controls depend entirely on behavior, and neither changes the hazard itself.

2. Skipping elimination because "we can't change the process"

Teams often assume elimination means shutting down the operation. In practice it is usually a design, purchasing or scheduling change. Skipping it locks in the hazard for the life of the equipment.

3. Counting a sign as an engineering control

Signs, floor markings and warning labels are administrative controls. Classifying them as engineering controls inflates the apparent strength of the plan and leads to under-scored residual risk.

4. Substituting without checking the substitute

A replacement chemical can have a lower toxicity but a lower flash point, or a quieter machine can bring a new pinch point. Substitution needs its own quick risk assessment.

5. Leaving interim PPE in place forever

Temporary harness or respirator use becomes permanent when no one owns the engineering fix. Put an end date and an owner on every interim control.

6. Not verifying that controls work

Local exhaust ventilation that is never tested, or interlocks that have been bypassed, give a false sense of security. Include engineering controls in your routine inspections.

---

How FindRisk Supports Hierarchy-Based Risk Control

FindRisk helps you apply the hierarchy of controls where hazards are actually found. During a walk-through, you can mark hazards directly on site photos and use AI analysis to help spot hazards you might have missed. The AI checklist generator can build an inspection list for the area you are assessing, which is a practical way to verify that guardrails, guards and ventilation are still in place.

Fine-Kinney risk assessment is built in, so you can score a hazard before controls and again after, and see whether the plan you chose moves the risk into an acceptable class. The finished assessment becomes a professional report in seconds, ready to share with managers or auditors. FindRisk runs on iOS and Android.

---

Frequently Asked Questions

What are the 5 levels of the hierarchy of controls?

The five levels, from most to least effective, are elimination, substitution, engineering controls, administrative controls and personal protective equipment. NIOSH, OSHA, HSE and ISO 45001 all use this order. Elimination removes the hazard, substitution replaces it with something less dangerous, engineering controls isolate people from it, administrative controls change how people work, and PPE protects the individual wearer.

Why is PPE considered the least effective control?

PPE is the least effective control because it leaves the hazard in place and protects only the person wearing it, and only when it is the right type, fits, is worn correctly and is in good condition. Any one of those failing removes the protection, often without anyone noticing. That is why HSE calls PPE the last resort and why many regulations require engineering controls first.

Is training an administrative control?

Yes. ISO 45001 Clause 8.1.2 lists "administrative controls, including training," and NIOSH gives work process training as an example of an administrative control. Training is essential for every other level to work, since people need to know how to use guards, ventilation and PPE, but on its own it does not change the hazard.

What is the difference between elimination and substitution?

Elimination removes the hazard completely, so there is no exposure. Substitution replaces the hazard with a less dangerous one, so some hazard remains. Doing a job at ground level instead of on a roof is elimination. Switching from a solvent cleaner to a water-based cleaner is substitution, because the new cleaner may still need handling precautions.

Is the hierarchy of controls a legal requirement?

In many jurisdictions, the principle is written into law even if the word "hierarchy" is not. EU Directive 89/391/EEC gives collective protection priority over individual protection, Turkey's Law No. 6331 Article 5 does the same, and several OSHA standards require engineering controls before respirators or hearing protection. Check the specific rules that apply to your country and hazard.

Can you use more than one level of control at the same time?

Yes, and you usually should. OSHA advises using a combination of control options when no single method fully protects workers. A typical plan uses the highest practicable level, such as a guardrail or local exhaust, and adds administrative controls and PPE for the remaining risk.

---

Conclusion

The hierarchy of controls is simple to state and harder to apply. Start every significant hazard at the top: ask whether it can be eliminated, then substituted, then engineered out, and only then rely on procedures and PPE. Record why higher options were not practicable, combine controls for the remaining risk, and put an owner and a date on each one.

The worked examples show that the strongest controls are usually physical and often decided upstream, at design and purchasing. PPE still has a place as an interim and residual measure, but a plan that relies on it alone depends on every person getting it right every time.

To see the hierarchy at work on your own site, download FindRisk, mark hazards on photos during your next walk-through, and score them before and after your controls.