Hierarchy of Controls: The Essential 2026 Guide to Choosing Safer Risk Controls

The hierarchy of controls is a ranking of ways to control workplace hazards, from the most effective, removing the hazard entirely, to the least effective, relying on people to wear protective equipment. It gives safety teams a disciplined way to answer the question that follows every risk assessment: what should we do about this hazard? The principle behind it is simple. Controls that work without people having to remember or comply are more reliable than controls that depend on constant human effort.

This guide explains the five levels, how ISO 45001 expects organizations to apply the hierarchy, how to use it in practice with examples, how to record decisions, and where teams commonly go wrong. It is written for health, safety and quality managers who maintain an integrated QHSE system.

The five levels of the hierarchy of controls

The US National Institute for Occupational Safety and Health, part of the CDC, presents the hierarchy as five levels, ordered from most to least effective. Its guidance says that elimination, substitution and engineering controls are more effective because they control exposure without significant human interaction, while administrative controls and personal protective equipment require ongoing worker effort. You can read the explanation on the CDC NIOSH hierarchy of controls page.

Level	What it does	Example
1. Elimination	Removes the hazard at its source	Stop using a toxic chemical
2. Substitution	Replaces the hazard with a safer alternative	Use water-based inks instead of solvent-based ones
3. Engineering controls	Isolates people from the hazard through equipment or design	Ventilation, machine guards, barriers
4. Administrative controls	Changes how people work to reduce exposure	Job rotation, training, procedures, scheduling
5. Personal protective equipment	Protects the individual worker	Gloves, safety glasses, hard hats, respirators

NIOSH recommends working from the top down and notes that multiple controls often work best together, particularly when one level alone cannot bring exposure to a safe level. That combined approach is common in practice: a machine guard (engineering), a lockout procedure (administrative) and safety footwear (PPE) may all apply to the same task.

How ISO 45001 uses the hierarchy of controls

ISO 45001, the international standard for occupational health and safety management systems, builds the idea into its planning and operational requirements. The standard asks organizations to establish processes for eliminating hazards and reducing OH&S risks using the hierarchy: eliminating the hazard, substituting less hazardous processes, materials or equipment, using engineering controls and reorganization of work, using administrative controls including training, and using adequate personal protective equipment. Read the exact wording of the clause on operational planning and control in your licensed copy.

The ISO page lists ISO 45001:2018 as the current published edition, with an amendment from 2024 dealing with climate action changes, and notes that a revision is under development. Check for a newer edition before you update documents. Our guide to whether ISO 45001 is a legal requirement explains how the standard relates to law, and the checklist for an ISO 45001 internal audit shows how auditors test the hierarchy in practice.

Applying the hierarchy of controls step by step

1. Identify the hazard and the task. Be specific about who is exposed, how, and for how long.
2. Ask whether the hazard can be eliminated. Can the task be avoided, moved or designed out? This question is asked far too rarely.
3. Ask whether a safer substitute exists. A less hazardous material, lower voltage, smaller container or different process.
4. Consider engineering controls. Guards, interlocks, ventilation, enclosures, lifting aids, barriers or automation.
5. Add administrative controls. Procedures, permits, training, signage, scheduling and supervision, where the earlier levels leave residual risk.
6. Finish with PPE. Select equipment that fits the hazard and the wearer, and train people to use and maintain it.
7. Record the reasoning. Note which levels were considered and why higher ones were not practicable.
8. Check the residual risk. Re-rate the risk after controls, and confirm that it is acceptable.
9. Verify and review. Confirm that the controls are in place and working, and review after incidents or change.

Worked examples

The following are hypothetical illustrations.

Example 1: manual handling of heavy drums

A warehouse worker lifts 25-kilogram drums onto a pallet, and back injuries have been reported. Elimination: could the supplier deliver in smaller containers or on ready-made pallets? If not, substitution: use smaller packaging. Engineering: add a drum lifter or a vacuum hoist. Administrative: rotate tasks and train workers in handling technique. PPE: safety footwear. The team chooses a drum lifter, a rotation schedule and training, and asks the supplier about smaller packs at the next contract review.

Example 2: solvent vapor in a cleaning process

A plant cleans parts with a solvent that gives off vapor. The team checks elimination, for example a mechanical cleaning method, and finds it cannot achieve the required finish. Substitution: they trial a water-based cleaner, which works for most parts. For the parts that still need solvent, they install local exhaust ventilation. Administrative controls include an exposure monitoring schedule and a limited-time work rule, and respirators are used only during maintenance, when ventilation is opened. The record shows each level and the reason for the decision.

Common mistakes with the hierarchy of controls

• Jumping to PPE and training. These are quick and cheap, but they are the least reliable and they leave the hazard in place.
• Not asking about elimination. Many hazards can be designed out at the planning stage, when change is cheap.
• Treating procedures as engineering. A written rule is administrative, however well written.
• No record of the reasoning. Auditors want to see why higher-level controls were not chosen.
• Ignoring new hazards. A substitute or guard may introduce another hazard, for instance a safer chemical with a different flammability.
• Forgetting maintenance. Engineering controls degrade and administrative controls decay unless checked.
• Static controls. Nothing changes after an incident or a process change.

Recording hierarchy of controls decisions

A good risk assessment form has columns for the hazard, existing controls, the level of each control in the hierarchy, additional controls considered, the chosen controls with owner and date, and the residual risk rating. A simple field asking “why was a higher level of control not used?” makes the reasoning visible and improves decisions. Store these records with your risk register, and link them to the training and procedure documents that the controls depend on. Our overview of the QHSE management system explains how these records fit together, and QHSE documentation lists the documents most systems keep.

Learning from incidents and near misses

Every incident investigation should ask which level of control failed and whether a higher one was available. If a worker was injured while wearing the required gloves, the question is not only why the gloves failed, but whether the hazard could have been removed, replaced or guarded. Record what was learned, update the risk assessment and share the result with similar workplaces in the organization. Track how many corrective actions target the upper levels of the ladder, since a program that only adds training and signage after each event is drifting toward the weakest kinds of control.

Leadership, workers and the hierarchy of controls

Elimination and engineering controls often need investment and design changes, so they need management support. Ask managers to consider the hierarchy when approving equipment and process changes, not only after an incident. Involve the people who do the job, since they know which controls will be used and which will be worked around. A guard that slows the task by half will often be removed, so design controls with the work in mind.

Documenting your hierarchy of controls in the QHSE system

Your system should include a hazard identification and risk assessment procedure that refers to the hierarchy, a risk assessment template with a control level field, a management of change process, a PPE procedure and training records. The QHSE Documentation Bundles provide a large library of quality, environmental and health and safety templates aligned to ISO 9001, ISO 14001 and ISO 45001 that you can adapt to your organization. Keep the procedures short and make the hierarchy visible in the forms people actually use.

Hierarchy of controls FAQ

What are the five levels of the hierarchy of controls?

Elimination, substitution, engineering controls, administrative controls and personal protective equipment, ordered from most to least effective.

Is PPE ever acceptable as the only control?

Sometimes, for short or unusual tasks where higher-level controls are not practicable, but it should be a considered decision, recorded, and not the default choice.

Does ISO 45001 require the hierarchy of controls?

Yes. The standard expects organizations to use the hierarchy when eliminating hazards and reducing risks, and auditors look for evidence that it is applied.

What is the difference between engineering and administrative controls?

Engineering controls change the physical situation, such as a barrier or ventilation, so that people are less exposed. Administrative controls change how people work, through procedures, training or scheduling.

Can we combine controls?

Yes. Using several controls together is common and often necessary, but start from the top of the hierarchy and add lower-level controls for the remaining risk.