The Hierarchy of Controls: The 5 Levels of Risk Control Explained

Every workplace has hazards. What separates a safe business from a dangerous one is not the absence of risk, it is how well that risk is controlled. And not all controls are equal. Handing someone a pair of gloves and removing the hazard entirely are both technically controls, but one is far more effective than the other. The hierarchy of controls is the simple, powerful framework that ranks control methods from most to least effective, and it is one of the most important ideas in all of health and safety.

The instinct in many businesses is to reach straight for personal protective equipment, because it is visible and cheap. But PPE sits at the bottom of the hierarchy for good reason. The most effective controls deal with the hazard at its source, before it can ever reach a person. Both the HSE's guidance on managing risk and the internationally used NIOSH hierarchy of controls are built on this principle. Here are the five levels, from most effective to least, and how to apply them.

1. Elimination

The most effective control is to remove the hazard completely. If the hazard is not there, it cannot harm anyone, which is why elimination sits at the very top of the hierarchy. This might mean removing a dangerous machine or process, designing out a risk at the planning stage, or stopping an unnecessary hazardous task altogether.

Elimination is not always possible, but it should always be the first question you ask: can we get rid of this hazard entirely? When the answer is yes, no other control comes close to matching it, because it does not depend on anything working correctly afterward.

2. Substitution

If a hazard cannot be eliminated, the next best option is to substitute it with something less dangerous. This means replacing a hazardous substance, material or process with a safer alternative that does the same job. Swapping a toxic cleaning chemical for a milder one, or a hazardous material for a benign substitute, are classic examples.

Substitution works at the source, reducing the inherent danger rather than just managing exposure to it. The key is to make sure the substitute genuinely reduces risk overall, and does not simply introduce a different hazard in its place. Assessing that properly is central to any COSHH approach to hazardous substances.

3. Engineering controls

Next come engineering controls, which isolate people from the hazard through physical means. Rather than changing the hazard itself, these put a barrier between the hazard and the person. Machine guarding, ventilation and extraction systems, barriers, and enclosures are all engineering controls.

These are highly effective because, once installed and maintained, they protect people without relying on them to remember to do anything. They work continuously and passively, which is what makes them far more dependable than controls that depend on human behaviour every single time.

4. Administrative controls

Administrative controls change the way people work. They include safe systems of work, procedures, training, signage, job rotation to limit exposure, and scheduling hazardous tasks for quieter times. Rather than removing or isolating the hazard, they manage how people interact with it.

Administrative controls are useful and often necessary, but they sit lower in the hierarchy because they depend on people following them correctly every time, and people are fallible. Training, manual handling procedures and safe working practices all fall here, and they work best when they support stronger controls rather than standing in for them.

5. Personal protective equipment

At the bottom of the hierarchy sits personal protective equipment: gloves, goggles, respirators, ear protection and the rest. PPE protects the individual, but only at the point of the hazard, only if it is worn correctly, and only if it fits and is maintained. It does nothing to reduce the hazard itself.

PPE is the last line of defence, not the first, and it should never be a business's primary control where something higher in the hierarchy is possible. It is genuinely important, but it is most effective when used to complement stronger controls, not to replace them. Relying on PPE alone is one of the most common signs that a hazard has not been properly controlled.

How to apply the hierarchy in practice

The hierarchy is not about choosing one level and stopping. In practice, good risk control usually combines several, always starting at the top and working down. For each hazard your risk assessment identifies, you ask in turn: can we eliminate it, substitute it, engineer it out, control it through how people work, and finally, what PPE is still needed to cover the residual risk?

This disciplined, top-down approach is what separates genuine risk control from box-ticking, and it is exactly what a thorough health and safety audit looks for. Auditors do not just check that controls exist, they check that the most effective controls have been used wherever reasonably practicable, rather than defaulting to the easy option. Applying the hierarchy properly, and being able to show you have, is a hallmark of a well-run safety system aligned with recognised frameworks such as ISO 45001.

Where Arinite fits

Arinite has spent 15+ years helping businesses control risk properly, using the full hierarchy rather than defaulting to the weakest option. We support 1,500+ businesses across 50+ countries and have helped protect 100,000+ employees, with a 95% client retention rate. Our health and safety services combine practical advice from qualified consultants with software that keeps risk assessments, controls and records visible across every site.

As global health and safety consultants, we help businesses apply the hierarchy of controls consistently wherever they operate, so that hazards are dealt with at the most effective level rather than simply managed at the individual. For organisations with teams across several countries, our international support keeps that standard consistent everywhere.

The fastest way to see whether your controls are as effective as they should be is a free gap analysis. Our specialists review your current arrangements and tell you plainly what is working and what is not. Book your free gap analysis and find out exactly where your business stands.