What Is the Hierarchy of Control? Levels & Examples

I was reviewing a contractor’s risk assessment for a grinding operation inside a fabrication shop — a routine pre-task audit on a large EPC project in the Gulf. The assessment identified respirable metal dust as the primary hazard. Under “control measures,” three items were listed: dust masks, safety briefing, and a generic work instruction. That was it. No extraction ventilation. No wet cutting methods. No enclosure. No consideration of whether the grinding task could be engineered out of the fabrication sequence altogether. Three workers were grinding stainless steel in a semi-enclosed bay with paper dust masks rated for nuisance dust, not metal fume. The hierarchy of control had been completely ignored — and the risk assessment looked compliant on paper.

This is not a rare scenario. Across every industry I have worked in — petrochemical shutdowns, mining operations, offshore platforms, large-scale construction — the hierarchy of control remains the single most misapplied framework in occupational health and safety. Teams cite it in toolbox talks, print it on posters, and reference it in permit-to-work templates. Yet the actual application on site consistently defaults to the bottom two tiers: tell workers what to do, give them PPE, and move on. Understanding what the hierarchy of control actually demands — and why the sequence matters — is the difference between genuine risk reduction and compliance theater that leaves workers exposed.

What Is the Hierarchy of Control? A Field-Based Definition

The hierarchy of control is a systematic, ranked framework used in occupational health and safety to select and implement hazard controls in order of effectiveness. Developed and promoted by NIOSH (the National Institute for Occupational Safety and Health) and embedded in ISO 45001:2018 Clause 8.1.2, it establishes a mandatory sequence: always pursue the most effective control first, and only move to less effective controls when higher-order measures are not reasonably practicable.

The framework is built on a simple principle that carries enormous operational weight. Higher-level controls reduce or remove the hazard at its source, independent of worker behavior. Lower-level controls depend entirely on people — their training, attention, compliance, and physical use of protective equipment. The hierarchy exists because decades of incident data prove one thing consistently: controls that rely on human behavior fail more often than controls that do not.

Here is how the five levels rank in terms of reliability and what each one demands in practice:

• Elimination (most effective): Remove the hazard completely from the workplace so no exposure is possible. No ongoing management required once implemented.
• Substitution: Replace the hazardous material, process, or equipment with a less dangerous alternative. Reduces severity even if exposure occurs.
• Engineering controls: Install physical systems — barriers, ventilation, interlocks, guarding — that separate workers from the hazard without requiring active human decision-making.
• Administrative controls: Change how work is organized and performed through procedures, training, signage, job rotation, and scheduling to reduce exposure duration or frequency.
• Personal protective equipment (PPE) (least effective): Equip individual workers with protective gear as the final barrier between the hazard and the body. Relies entirely on correct selection, fit, maintenance, and consistent use.

ISO 45001:2018, Clause 8.1.2 requires organizations to plan actions to address risks using the hierarchy of controls, explicitly prioritizing elimination, then substitution, then engineering controls — and only then considering administrative controls and PPE as supplementary measures.

Pro Tip: When I audit risk assessments, I look for what I call the “PPE reflex.” If the first control measure listed for any hazard is PPE, the assessment has almost certainly skipped the hierarchy. Train your teams to start every risk discussion with one question: Can we get rid of this hazard entirely? Only after that answer is documented as “no — and here’s why” should anyone move down the hierarchy.

Elimination — Removing the Hazard at the Source

Elimination sits at the top of the hierarchy of control because it is the only level that reduces residual risk to zero for that specific hazard. When a hazard is eliminated, there is nothing left to manage, monitor, or protect against. No PPE selection debates. No refresher training schedules. No compliance audits for that particular exposure. The hazard simply does not exist in the workplace anymore.

The challenge — and the reason elimination is underused — is that it requires thinking about hazards before they are built into the work process. Once a plant is constructed, a procedure is embedded, or equipment is installed, elimination becomes exponentially harder and more expensive. The greatest elimination opportunities exist during the design and planning phase, which is precisely when safety professionals are least likely to be consulted.

Real-world elimination looks different across industries, but the principle is identical — remove the need for the hazardous activity altogether:

• Design-out the hazard: A fabrication project I worked on originally required workers to weld structural connections at a height of 14 meters. The engineering team redesigned the assembly sequence so all welding was completed at ground level before the sections were lifted into position. The working-at-height hazard for welding was eliminated entirely.
• Remove the hazardous substance: Replacing a chemical cleaning process with a mechanical one — such as using abrasive blasting instead of solvent degreasing — eliminates chemical inhalation and skin absorption hazards from that task.
• Eliminate the task: During a plant turnaround, a team was scheduled to manually enter a vessel to inspect internal weld integrity. By deploying a robotic crawler with a camera and ultrasonic testing head, the confined space entry — and every hazard associated with it — was eliminated from the scope.
• Automate the exposure: Removing manual material handling by installing conveyor systems or robotic palletizers eliminates musculoskeletal injury risk from repetitive lifting tasks.

The most important thing I have learned about elimination is that it almost never comes from the safety department alone. It requires collaboration with design engineers, process engineers, project planners, and procurement teams during early project phases. By the time a safety officer writes a risk assessment for an existing task, the window for elimination has usually closed.

Pro Tip: Push for safety involvement in the design review stage — HAZOP, constructability reviews, and detailed engineering. Every hazard eliminated on a drawing costs a fraction of what it costs to control on site. I have seen single design changes during Front-End Engineering Design (FEED) eliminate hazards that would have required years of administrative controls and PPE programs to manage during operations.

Substitution — Replacing Danger with a Safer Alternative

Substitution occupies the second tier because it does not remove the hazard entirely — it replaces it with something less dangerous. The risk is reduced, not eliminated. A residual hazard still exists, but its severity, toxicity, flammability, or exposure potential is significantly lower than the original.

The distinction between elimination and substitution is critical and frequently confused on site. If a chemical solvent is removed from the process entirely and replaced with a water-based mechanical cleaning method, that is elimination — the chemical exposure hazard no longer exists. If the same solvent is replaced with a less toxic solvent that still requires handling controls, that is substitution — the hazard category remains, but the consequences of exposure are reduced.

Substitution decisions require technical competence and careful evaluation because replacing one hazard can sometimes introduce a new, unexpected one. The following examples illustrate effective substitution across different operational contexts:

• Less toxic chemical agents: Replacing chromium-based anti-corrosion primers with zinc-phosphate alternatives reduces the carcinogenic exposure risk during spray application. The painting hazard still exists, but the health consequence shifts from potential cancer to manageable irritation.
• Lower energy processes: Substituting oxy-fuel cutting with plasma cutting on certain steel grades reduces the fire and explosion risk associated with acetylene gas storage and use on site.
• Safer material forms: Using pre-mixed, low-VOC adhesives instead of solvent-based two-part systems in flooring installation reduces inhalation hazard severity from acute neurological effects to mild respiratory irritation.
• Less hazardous equipment: Replacing a manually operated overhead crane with a semi-automated gantry system with load-limiting sensors reduces the risk of uncontrolled load swings and operator error during heavy lifts.

I reviewed an incident on a mining operation where a maintenance crew was using carbon tetrachloride as a degreaser for heavy equipment components — a substance classified as a Group 2B possible carcinogen with severe liver and kidney toxicity. The MSDS was on file. The crew had been briefed. They were wearing nitrile gloves. But nobody had asked the substitution question: is there a less hazardous degreaser that does the same job? Within a week of the investigation, the site switched to a biodegradable citrus-based degreaser with a fraction of the toxicity profile. The task was identical. The performance was comparable. The health risk dropped by orders of magnitude.

The following table shows how substitution applies across common workplace hazard categories:

Original Hazard	Substitution Example	Risk Reduction Achieved
Lead-based paint removal	Switch to non-lead coating systems	Eliminates lead exposure; residual dust hazard remains
Silica-containing abrasive blasting media	Substitute with garnet or steel grit	Removes silicosis risk; residual nuisance dust remains
Mercury thermometers in process units	Replace with digital or alcohol thermometers	Eliminates mercury spill and vapor exposure
Solvent-based cleaning agents (toluene)	Replace with aqueous or citrus-based cleaners	Reduces inhalation and dermal toxicity significantly
Manual scaffold erection at height	Use pre-fabricated modular scaffold systems	Reduces fall exposure time and complexity

OSHA’s General Duty Clause (Section 5(a)(1)) requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm. When a less hazardous substitute exists and is feasible, continuing to use the more dangerous option becomes increasingly difficult to defend — both legally and ethically.

Pro Tip: The biggest resistance to substitution I encounter on site is the phrase “we’ve always used this.” Legacy chemicals, legacy processes, legacy equipment — they persist not because they are the best option, but because nobody has formally asked whether a safer alternative exists. Make substitution assessment a standing item in procurement reviews and chemical approval processes. If a new substance enters your site, it should have to justify why a less hazardous option was not selected.

Engineering Controls — Building Safety into the Physical Environment

Engineering controls represent the first tier of the hierarchy where the hazard is not removed or replaced — it still exists — but a physical barrier, system, or design feature is placed between the worker and the hazard. The defining characteristic of engineering controls is that they function independently of worker behavior. A machine guard does not require the operator to remember to use it. A local exhaust ventilation system does not depend on the worker choosing to stand in the right position. An interlock does not rely on someone reading a procedure before pressing a button.

This independence from human decision-making is what makes engineering controls fundamentally more reliable than administrative controls or PPE. They represent the last level of the hierarchy where protection is built into the environment rather than loaded onto the individual.

Engineering controls take many forms depending on the hazard type, industry, and operational context. The following categories cover the most common applications I have encountered across heavy industry, construction, and chemical operations:

• Physical barriers and guarding: Fixed guards on rotating machinery, railings around open edges, blast shields on grinding stations, and Lexan enclosures around CNC lathes. These physically prevent body contact with the hazard.
• Ventilation systems: Local exhaust ventilation (LEV) at the source of dust, fume, or vapor generation. Push-pull ventilation in spray booths. Dilution ventilation in enclosed work areas. These reduce airborne contaminant concentrations below occupational exposure limits.
• Isolation and containment: Acoustic enclosures around high-noise equipment, chemical bunding around storage tanks, and glove boxes for handling highly toxic materials. These contain the hazard within a defined boundary.
• Interlocks and safety devices: Machine interlocks that cut power when a guard is opened. Pressure relief valves that prevent vessel overpressurization. Dead-man switches on mobile plant that stop the machine if the operator releases the control. These intervene automatically when a hazardous condition is detected.
• Ergonomic design: Adjustable workstations that prevent sustained awkward postures. Mechanical assists for repetitive lifting. Tool redesign to reduce grip force requirements. These redesign the task interface to reduce musculoskeletal strain at the source.

On a chemical plant expansion project in Southeast Asia, the original design had operators manually sampling process fluid from a high-pressure line by opening a valve and filling a bottle. The hazard was chemical splash and high-pressure injection injury. The administrative control in the existing procedure was “wear face shield and chemical gloves, stand to the side, open valve slowly.” After three near-miss reports in six months — including one where a gasket failure sent hot caustic across an operator’s forearm despite gloves — the engineering team installed closed-loop sampling systems with automatic purge and containment. The operator now initiates the sample from a panel three meters away. The exposure is gone. Not reduced. Gone.

The critical distinction I emphasize during audits is between engineering controls and engineered workarounds. A real engineering control changes the physical relationship between the worker and the hazard. An engineered workaround — like adding a longer tool handle so the worker can reach into a hazardous area from farther away — may reduce exposure, but it does not create a true barrier. The test is simple: if the worker makes a mistake, does the engineering control still protect them? If yes, it is a genuine engineering control. If no, it is an administrative control dressed up in hardware.

Engineering Control Type	Example	Hazard Addressed	Protection Mechanism
Fixed guarding	Mesh guard on belt conveyor nip point	Entanglement	Physical barrier prevents body contact
Local exhaust ventilation	Welding fume extraction arm	Respiratory exposure	Captures contaminant at source before inhalation
Acoustic enclosure	Soundproof housing on diesel generator	Noise-induced hearing loss	Contains noise energy within enclosure
Machine interlock	Guard-activated power cutoff on press brake	Crush injury	Removes energy when guard is not in position
Fall prevention system	Fixed edge protection on elevated platform	Fall from height	Passive barrier prevents approach to edge

Administrative Controls — Changing How People Work

Administrative controls sit at the fourth level of the hierarchy of control, and this is where the fundamental nature of protection changes. Everything above this level — elimination, substitution, engineering — modifies the hazard, the substance, or the physical environment. Administrative controls modify worker behavior. They tell people what to do, when to do it, how to do it, and who is authorized to do it. The hazard remains fully present. The environment is unchanged. The only thing standing between the worker and the harm is whether they follow the rules.

This is not a dismissal of administrative controls. They are essential. No workplace operates without procedures, training, permits, and supervision. But the hierarchy exists precisely because these controls have a documented, consistent, and predictable failure rate that is higher than any physical control. People forget. People take shortcuts. Procedures become outdated. Training degrades over time. Supervision has gaps. Fatigue, production pressure, complacency, and language barriers all erode administrative control effectiveness in ways that do not affect a machine guard or a ventilation system.

The range of administrative controls used in workplace safety is broad, and most organizations rely heavily on this tier — sometimes appropriately, often excessively:

• Safe work procedures and method statements: Written documents that define step-by-step how a task must be performed safely. Effective only when workers have read, understood, and internalized them — and when the procedure matches actual site conditions.
• Permit-to-work systems: Formal authorization systems for high-risk activities (hot work, confined space entry, isolation, working at height). Permits force a documented check of controls before work begins — but their effectiveness depends entirely on the quality of the hazard assessment and the rigor of the authorizing authority.
• Training and competency programs: Initial and refresher training on hazard awareness, safe procedures, and emergency response. The gap between “trained” and “competent” is where most administrative control failures live.
• Signage and warning systems: Hazard signs, safety data sheets, exclusion zone markings, and audible alarms. These communicate hazard information — but communication is not control. A warning sign has never stopped a chemical from being toxic.
• Job rotation and exposure scheduling: Limiting individual worker exposure time to a hazard by rotating personnel through tasks. Common in noise exposure management and heat stress prevention. Effective for cumulative dose reduction, but does not reduce the hazard intensity for the person currently exposed.
• Supervision and behavioral observation: Direct oversight of work activities by competent supervisors. The most effective administrative control available — and the most resource-intensive.

I investigated a hand injury on a manufacturing line where an operator reached into a conveyor transfer point to clear a product jam. The machine had a “lockout required” sign posted. The operator had been trained on lockout-tagout. The procedure was documented, reviewed, and signed. The supervisor was on break. The production target was 15 minutes behind schedule. The operator reached in without isolating. Every administrative control was in place. Every one failed at the moment it mattered because the hazard — the moving conveyor — was still physically present and accessible.

This is not an indictment of the operator. It is an indictment of relying on administrative controls as a primary defense when an engineering control — a fixed guard with an interlock that physically prevented access to the nip point — would have made the injury impossible regardless of the operator’s decision.

HSE UK’s guidance on the Management of Health and Safety at Work Regulations 1999 states that administrative controls should only be relied upon where risks cannot be adequately controlled by higher-order measures. They are supplementary — not substitutes for physical controls.

Pro Tip: Here is the test I apply during every audit: for each administrative control listed in a risk assessment, I ask, “What happens when this control fails at 2 AM on a night shift with a fatigued crew and no supervisor on the floor?” If the answer is “the worker is exposed to the full hazard,” then that control is not adequate as a standalone measure. You need something above it in the hierarchy.

Personal Protective Equipment (PPE) — The Last Line of Defense

PPE occupies the bottom of the hierarchy of control for a reason that every field professional should internalize: it is the only control level where the hazard reaches the worker’s body, and a single piece of equipment is all that stands between exposure and injury. The hazard is present. The environment is unchanged. The work process is unchanged. The only thing different is that the worker is wearing something designed to absorb, deflect, filter, or block the hazard at the point of contact.

When PPE works correctly — the right type, properly fitted, consistently worn, well maintained, and appropriate for the specific exposure — it provides genuine protection. The problem is that every one of those conditions must be met simultaneously, every time, for every worker, on every shift. Failure of any single condition means the worker is exposed as if the PPE did not exist.

The most common categories of PPE encountered across industrial operations include the following, each with its own selection criteria, limitations, and failure modes:

• Respiratory protection: Half-face and full-face air-purifying respirators, powered air-purifying respirators (PAPRs), and supplied-air breathing apparatus (SCBA). Selection depends on contaminant type, concentration, oxygen level, and assigned protection factor. The most frequently failed control in my audit experience — fit testing compliance alone runs below 60% on most sites I have assessed.
• Head protection: Industrial safety helmets (Type I top-impact, Type II top-and-lateral-impact) with or without chin straps, face shields, and visors. Common failure: helmets worn beyond their service life or without replacement after impact.
• Hand protection: Chemical-resistant gloves (nitrile, neoprene, butyl, PVA), cut-resistant gloves (ANSI/ISEA cut levels A1–A9), thermal gloves, and vibration-damping gloves. The single most common PPE error on every site I have worked: wrong glove for the specific chemical. A nitrile glove that resists one solvent may offer zero protection against another.
• Eye and face protection: Safety spectacles, goggles (sealed and vented), face shields, and welding helmets with auto-darkening filters. Selection failures are routine — splash goggles required but safety glasses worn because goggles “fog up.
• Hearing protection: Foam earplugs, pre-molded earplugs, earmuffs, and electronic attenuation devices. Real-world attenuation is typically 50–75% of the Noise Reduction Rating (NRR) due to improper insertion and fit.
• Fall protection: Full-body harnesses with shock-absorbing lanyards, self-retracting lifelines (SRLs), and horizontal lifeline systems. PPE, not engineering — because the worker is still exposed to the fall hazard; the harness arrests the fall after it begins.
• Body and skin protection: Flame-resistant (FR) coveralls, chemical splash suits, high-visibility vests, and arc-flash rated clothing. Selection must match the specific thermal, chemical, or visibility hazard.

One statistic has stayed with me throughout my career: NIOSH research consistently shows that PPE is the sole or primary control in a disproportionate number of fatalities investigated across US industries. Not because the PPE was absent — but because it was the wrong type, improperly used, poorly maintained, or simply not sufficient for the actual exposure severity. When PPE is your only control, every failure is a direct hit on the worker.

PPE Category	Common Site Failure	Consequence of Failure
Respiratory protection	Wrong cartridge for contaminant; failed fit test	Full inhalation exposure at ambient concentration
Chemical gloves	Wrong material for specific chemical	Permeation — chemical passes through glove to skin
Hearing protection	Earplugs not inserted correctly	Effective NRR drops from 29 dB to as low as 5 dB
Fall arrest harness	Lanyard too long for available fall distance	Ground impact before shock absorber fully deploys
Eye protection	Safety glasses worn instead of sealed goggles	Splash enters from sides — chemical eye burn

OSHA 29 CFR 1910.132(d)(1) requires employers to assess the workplace to determine if hazards are present that necessitate PPE, and to select PPE that properly protects workers against those specific hazards. The standard explicitly positions PPE as protection against hazards “that cannot be eliminated through engineering or administrative controls” — reinforcing its place as the last resort.

Why the Order Matters — The Inverted Pyramid of Reliability

The hierarchy of control is not a menu where you pick the option that is most convenient or cheapest. It is a decision sequence with a built-in logic: the higher you go, the more reliable the protection and the less dependent it is on human behavior. The lower you go, the more the system relies on every individual worker making the right decision, every time, under every condition — including fatigue, stress, production pressure, and inadequate supervision.

Understanding why the order matters requires looking at how each level performs under real operational stress. The following comparison shows what happens to each control tier when conditions deteriorate — which they always do:

• Elimination: The hazard does not exist. Deteriorating conditions are irrelevant. A hazard that has been designed out cannot reappear because a supervisor left early or a worker skipped a step.
• Substitution: The reduced-hazard substitute remains in place regardless of shift patterns, training quality, or supervision gaps. The lower-toxicity chemical does not become more toxic because production is behind schedule.
• Engineering controls: The machine guard stays bolted on during night shift. The ventilation system runs whether or not the operator remembers to check the procedure. Degradation is possible — guards can be removed, systems can fail — but the default state is protection ON.
• Administrative controls: Effectiveness drops measurably with every real-world variable: new hire unfamiliar with procedures, language barrier with safety briefing, supervisor absent, procedure not updated after process change, crew fatigued at end of a 12-hour shift. Default state drifts toward non-compliance over time without active enforcement.
• PPE: Every variable that degrades administrative controls also degrades PPE, plus additional physical variables: incorrect donning, poor fit, degraded materials, discomfort causing removal, incompatibility between PPE items (respirator strap interfering with helmet, goggles fogging with respirator exhalation valve).

I once mapped PPE compliance rates across four consecutive 12-hour shifts on a refinery turnaround. Shift 1 (day, rested crew, full supervision): 94% compliance. Shift 2 (day, same crew, afternoon): 87%. Shift 3 (night, rotated crew, reduced supervision): 71%. Shift 4 (night, extended shift due to schedule pressure): 58%. The PPE did not change. The hazard did not change. The human variables changed — and compliance collapsed. An engineering control — say, a fixed ventilation system — would have performed at 100% effectiveness across all four shifts.

This is the fundamental argument for respecting the hierarchy of control as a sequence, not a selection. The order is the point. It forces decision-makers to confront the most effective options first and document why they are not feasible before stepping down to less reliable controls.

Control Level	Reliability Under Normal Conditions	Reliability Under Stress / Degraded Conditions	Dependence on Human Behavior
Elimination	100%	100%	None
Substitution	~95–100%	~95–100%	Minimal (procurement, specification)
Engineering	~90–98%	~85–95%	Low (maintenance, inspection)
Administrative	~70–85%	~40–60%	High (training, compliance, supervision)
PPE	~60–80%	~30–55%	Very high (fit, use, maintenance, selection)

Common Mistakes in Applying the Hierarchy of Control

Despite being one of the most widely taught concepts in HSE, the hierarchy of control is consistently misapplied on site. The gap between knowing the framework and actually using it to drive risk assessment decisions is enormous. I have audited hundreds of risk assessments across multiple industries, and the same patterns of failure repeat with striking consistency.

The following mistakes are not theoretical. They are drawn from real audit findings, incident investigations, and management review observations across construction, petrochemical, mining, and manufacturing environments:

• Defaulting to PPE as the first response: The most common failure. A hazard is identified, and the immediate response is “what PPE do we need?” instead of “can we eliminate, substitute, or engineer this out?” PPE becomes the default because it is fast, visible, and does not require design changes or capital expenditure. This is compliance, not safety.
• Listing controls without following the hierarchy sequence: Risk assessments that list multiple controls — ventilation, procedure, PPE, training — without demonstrating that higher-order controls were considered and ruled out before lower-order ones were accepted. The hierarchy is a decision sequence, and that sequence must be documented.
• Treating administrative controls as equivalent to engineering controls: Writing a procedure and calling a hazard “controlled” when a physical barrier would be more effective and feasible. A procedure to “maintain three-point contact on ladders” is not equivalent to installing a fixed staircase with handrails.
• Confusing substitution with elimination: Replacing one chemical with a less hazardous one is substitution, not elimination. The hazard category still exists — its severity is reduced. This distinction matters because substitution still requires downstream controls (handling procedures, PPE for residual risk), while true elimination does not.
• Ignoring feasibility analysis at higher tiers: Jumping from “elimination is not possible” directly to PPE without formally assessing substitution and engineering options. The hierarchy requires each level to be assessed and documented before moving to the next.
• Static application — assessing once and never revisiting: The hierarchy should be reapplied when processes change, new technology becomes available, incidents occur, or monitoring data reveals that existing controls are insufficient. A control strategy that was best-available five years ago may no longer be adequate.

During a management systems audit at a mining operation in Western Australia, I found 47 risk assessments where the top-listed control for noise exposure was “hearing protection mandatory.” Only 3 of those 47 assessments documented any consideration of engineering noise reduction — acoustic enclosures, vibration dampening, equipment substitution, or maintenance-driven noise reduction. The remaining 44 had gone straight from “hazard identified: noise above 85 dB(A)” to “control: earmuffs.” The hierarchy had been printed on every assessment form — literally as a sidebar reference — and ignored in every assessment decision.

Pro Tip: Build the hierarchy into your risk assessment template as a forced field. Require assessors to document what was considered at each level — elimination, substitution, engineering — and why it was or was not implemented, before administrative controls and PPE can be entered. If the higher-order fields are blank, the assessment is incomplete. This single template change has improved hierarchy compliance on every project where I have implemented it.

Applying the Hierarchy of Control — A Practical Field Example

Theory is useful. Application is where workers get protected or get hurt. To illustrate how the full hierarchy works in practice, consider a hazard that exists on almost every industrial and construction site: manual handling of heavy materials causing musculoskeletal injuries.

The following walkthrough demonstrates how each level of the hierarchy applies to this single hazard, from top to bottom, with practical field decisions at every stage:

1. Elimination — Remove the manual handling entirely. Can the process be redesigned so workers never lift the material at all? For example, specifying pre-fabricated pipe spools delivered to the installation point by crane instead of individual pipe lengths carried by hand. If the lifting task is eliminated from the work scope, the musculoskeletal hazard disappears.
2. Substitution — Reduce the weight or awkwardness. If manual handling cannot be fully eliminated, can the materials be substituted with lighter alternatives? Switching from concrete blocks to lightweight aerated blocks, using plastic conduit instead of steel where specifications allow, or ordering materials in smaller package sizes that fall within safe manual handling limits.
3. Engineering controls — Provide mechanical assistance. If workers still need to move materials, install vacuum lifters, mechanical hoists, adjustable-height trolleys, or conveyor systems at the work point. These reduce the physical force required without depending on the worker’s lifting technique.
4. Administrative controls — Change how the work is organized. Implement team lifting protocols for items above the single-person limit. Rotate workers through physically demanding tasks to distribute cumulative load. Schedule heavy handling tasks for the start of shift when fatigue is lowest. Provide manual handling training with task-specific technique guidance.
5. PPE — Equip the worker. Provide back-support belts (noting that evidence for their effectiveness in preventing injury is limited and contested), anti-vibration gloves for powered tool handling, and appropriate footwear with grip and ankle support for carrying loads on uneven surfaces.

Notice the pattern. At level 1, the hazard is gone. At level 2, it is reduced. At level 3, a physical system does the heavy work. At level 4, you are relying on people to lift correctly, rotate on schedule, and follow procedures. At level 5, you are hoping a belt supports a spine that is already under load. The difference in reliability is not subtle — it is the difference between a system that protects workers by design and a system that protects workers only when everything goes right.

In practice, most sites will implement a combination of multiple hierarchy levels simultaneously. The best outcomes I have seen use elimination and engineering as the foundation, with administrative controls and PPE as supplementary layers for residual risk that cannot be further reduced. The worst outcomes I have seen rely on levels 4 and 5 alone and call it a “safe system of work.”

The Cost Argument — Why Higher-Order Controls Save Money Long-Term

One of the most persistent barriers to implementing higher-order controls on the hierarchy is cost. Engineering controls require capital expenditure. Design changes require rework. Elimination requires rethinking processes that are already in motion. PPE, by contrast, appears cheap — buy a box of gloves, issue them, move on. Administrative controls appear free — write a procedure, deliver a toolbox talk, done.

This perception is a financial illusion. The true cost of relying on lower-order controls becomes apparent only when you account for the full lifecycle of hazard management. I have presented the following cost comparison to project directors and operations managers dozens of times, and it consistently shifts budget decisions toward higher-order investment:

• PPE lifecycle costs are chronic and compounding: Consumable PPE (gloves, earplugs, respirator cartridges) requires continuous procurement, storage, distribution, fit testing, inspection, replacement, and disposal. Across a workforce of 500 on a 3-year construction project, respiratory PPE programs alone can cost $200,000–$400,000 — without a single engineering control reducing the exposure.
• Administrative control costs are hidden in labor: Every procedure needs writing, reviewing, training, refresher cycles, compliance monitoring, audit, and enforcement. Permit-to-work systems consume supervisor hours. Training programs consume worker hours. Behavioral observation programs require dedicated safety staff. These costs never appear as a line item labeled “hierarchy failure” — but they are.
• Engineering controls are capital costs with declining maintenance curves: A local exhaust ventilation system on a welding bay costs $15,000–$30,000 installed. Once commissioned, annual maintenance costs $1,000–$3,000. It operates for 15–20 years. Compare that to 15–20 years of respirator programs, fit testing, training, and compliance enforcement for every welder who works in that bay.
• Elimination has no ongoing cost: A hazard that does not exist costs nothing to manage. Zero PPE. Zero procedures. Zero training. Zero audit findings. Zero incident investigations. The design-stage investment pays for itself before the first worker sets foot on site.

The Health and Safety Executive (UK) consistently emphasizes that the cost of prevention is almost always lower than the cost of failure — considering direct costs (medical, compensation, equipment damage), indirect costs (investigation, legal, regulatory penalties), and intangible costs (reputation, morale, recruitment difficulty).

Conclusion

The hierarchy of control is not a poster for the safety notice board or a checkbox on a risk assessment template. It is a decision-making discipline that determines whether your controls actually reduce risk or merely create the appearance of safety. Every time a risk assessment skips from hazard identification to PPE selection without documenting what was considered at elimination, substitution, and engineering levels, the hierarchy has failed — not as a concept, but as a management system function.

What I have seen across a decade of field work is consistent: the sites with the lowest incident rates are not the ones with the most PPE or the thickest procedure manuals. They are the sites where design engineers, project managers, and safety professionals sit in the same room during the planning phase and systematically work through the hierarchy from the top down. They eliminate what can be eliminated. They substitute what can be substituted. They engineer barriers for what remains. And only then — for the residual risk that genuinely cannot be controlled by any other means — do they reach for administrative controls and PPE.

Safety is not a product you buy in a box or print on a page. It is built into the design, the process, the equipment, and the environment — or it is not built in at all. The hierarchy of control gives you the roadmap. Whether you follow it from the top or skip to the bottom is the choice that determines whether your workers go home safe or go home injured. There is no version of professional safety practice where that choice does not matter.