Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Hierarchy of Controls

    Definition

    An order for considering hazard controls: elimination, substitution, engineering controls, administrative controls and personal protective equipment.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/hierarchy-of-controls

    Scope: Higher levels generally reduce reliance on individual behaviour; the task may require several controls.

    Sources checked: . Examples are editorial illustrations.

    The order of controls in NIOSH and EU guidance

    NIOSH presents the hierarchy of controls as five levels in order of preference: elimination, substitution, engineering controls, administrative controls and personal protective equipment. It explains the order by how much each level depends on people. Elimination, substitution and engineering controls control exposures without significant human interaction, while administrative controls and PPE require significant and ongoing effort by workers and their supervisors. NIOSH describes administrative controls as work practices that reduce the duration, frequency or intensity of exposure, with job rotation, training and access restrictions as examples, and says employers should not rely on PPE alone where other effective controls are available.

    The same logic appears in law. The EU's Framework Directive 89/391/EEC requires the employer to apply general principles of prevention, which include avoiding risks, evaluating the risks that cannot be avoided, combating risks at source, replacing the dangerous by the non-dangerous or the less dangerous, and giving collective protective measures priority over individual protective measures. The Directive does not set out the five-level picture, so a statement that a law requires the NIOSH hierarchy would overstate it. The principles are the legal anchor in the EU and the hierarchy is a practical way of applying them.

    The hierarchy is a method for choosing between options, not a checklist of five boxes. A task often needs several controls at different levels, and the useful question for each hazard is whether a higher level was considered and, if it was rejected, why. Cost and feasibility legitimately enter that choice. What the record should show is that the decision was reasoned and not simply the cheapest or quickest option. Published versions of the model differ in detail, so check which one a policy or a customer requirement refers to. This page is general information and not advice on a particular workplace.

    Sources opened :

    What a control-selection record holds in software

    • The hazard and the task or process it arises in, linked to the risk assessment that identified it.
    • The options considered at each level: whether the hazard could be eliminated, a safer substance or method substituted, an engineering control applied, then administrative controls and PPE.
    • The reason each higher option was adopted or rejected (feasibility, cost, new hazards created), written in words and not only coded.
    • The controls selected, each tagged with its level, owner, due date and the evidence that it is in place.
    • A verification entry showing how it was checked that the control works in practice, and the review date.
    • The residual risk after controls and who accepted it.

    Hierarchy of controls, risk matrix and safe system of work

    A risk matrix rates how serious a risk is. The hierarchy says which kind of control to prefer once the risk is known. They answer different questions and are used one after the other. The hierarchy is also not the same as a safe system of work or a permit, which are mostly administrative controls: they sit in the fourth level and depend on people following them. A tool that stores a risk score does not by that fact record whether a higher-level control was considered.

    A hypothetical example: noisy cutting in a workshop

    This case is invented to illustrate the reasoning and describes no real workshop. An assessment finds that a cutting operation produces noise above the level at which the employer has decided that action is needed. The team walks down the levels. Could the cutting be eliminated? The supplier can cut stock to length, at a delay and cost the business accepts only for the commonest sizes, so part of the work is eliminated. Could a quieter process be substituted? A trial of a different blade gives a modest reduction. Could engineering controls help? An enclosure for the main saw is feasible and is bought. Administrative controls follow: rotation between loud and quiet tasks, signage and scheduled hearing checks. Hearing protection is issued for the exposure that remains, and the record says plainly that it is the last layer.

    The register shows not only which levels were used but why elimination covered only part of the work, and a verification entry: measurements after the enclosure was fitted show the reduction, and a review date is set. If an audit later asks why the business did not simply hand out ear defenders, the record answers the question without anyone having to remember the discussion.

    Common misunderstandings about the hierarchy of controls

    • The levels are not equal alternatives. They are ordered because the higher ones rely less on individual behaviour, so choosing a lower level needs a reason.
    • A lower-level control is not always wrong. Where a higher one is not feasible or would create a new hazard, a combination of controls can be the right answer, provided the record says why.
    • Training and procedures are not engineering controls. NIOSH classes them as administrative controls, which need ongoing effort from workers and supervisors.
    • Elimination is not limited to removing a physical object. Changing the design, the sequence or the need for the task can remove the exposure, which is why the question is worth asking at planning time.
    • The hierarchy is guidance, not a statute. Legal duties come from the applicable regime, such as the EU's general principles of prevention, so a tool should not describe its fields as meeting a law.

    How the hierarchy of controls relates to other glossary terms

    The hierarchy is a way of ordering decisions that other glossary terms record or depend on.

    • PPE: the last level, to be used where hazards remain after higher controls.
    • Permit to work: mostly an administrative control, which coordinates and records other controls and does not replace them.
    • Incident investigation: tests whether the controls at each level worked and often leads to a higher-level fix.
    • ISO 45001: the occupational health and safety management standard, whose operational planning is concerned with eliminating hazards and reducing risks.

    Records and evidence that usually exist for control selection

    • The risk assessment that identified the hazard and the people exposed.
    • A record of the options considered at each level and the reason each was taken or set aside.
    • Design changes, purchase records or work instructions showing the control was put in place.
    • Measurements, inspections or observations that show the control works.
    • Training and communication records for administrative controls.
    • Review records showing when the choice was last revisited and what changed.

    What a software tool needs to capture for the hierarchy of controls

    • A control field that records the level, not only a description, and allows more than one control per hazard.
    • A free-text reason for the choice at each level, kept with the control and not lost when the status changes.
    • A way to see all hazards that rely on administrative controls or PPE alone, as a prompt to look again.
    • Verification fields with a method, a date and a reviewer, separate from the field that records completion.
    • A link to the assessment and, where a change triggers a review, to the change record.
    • A read-only history of how the choice changed over time.

    Catalog profiles documenting risk assessment workflows

    The list comes from the risk assessment workflow rule. It does not show that a product records the order of controls, which is worth asking each supplier to demonstrate.

    Same rule for every product: tagged “Risk Assessment” or “Risk Management”, with a sourced risk assessment or risk register capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 37 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is the hierarchy of controls a legal requirement?

    The five-level model is guidance, for example from NIOSH. Legal duties come from the rules that apply. The EU Framework Directive 89/391/EEC, for instance, lists general principles of prevention, including giving collective protective measures priority over individual ones.

    Where do procedures and permits sit?

    NIOSH describes administrative controls as work practices that reduce the duration, frequency or intensity of exposure. They depend on people following them, so they rank below engineering controls.

    What should a software tool record?

    The options considered at each level, the reason for the choice, the owner and the verification evidence, not only a final risk score.

    More safety terms

    Related guides