The Hierarchy of Controls: How to Apply it in the Workplace

This is the third in a four-part series on building a comprehensive workplace safety system.

Quick Answer: What the Hierarchy of Controls Does

Answer first: The Hierarchy of Controls ranks five levels of risk control in a preferred order, from most to least effective. Duty holders apply the highest control measures that are reasonably practicable, then step down a level only when no stronger option exists.

• Level 1 – Elimination: remove the hazard completely (strongest outcome).
• Level 2 – Substituting: swap a hazardous item or process for something safer.
• Level 3 – Engineered controls: guarding, ventilation, edge protection.
• Level 4 – Administrative measures: procedures, rosters, signage, induction.
• Level 5 – Personal protective equipment: worn protection, applied as a last resort.

The Gold Standard for Managing Risk

In Weeks 1 and 2, you learned how to identify hazards and assess their risks. Now, you’re ready for the most important part of the safety process: controlling those risks. But how do you choose the right control measure?

Under Australia's Work Health and Safety (WHS) Act, businesses have a duty to eliminate or minimise risks as far as is reasonably practicable. To help with this, Safe Work Australia has established the Hierarchy of Controls, which is the internationally recognised gold standard for managing workplace risks.

This hierarchy is a step-by-step guide, ranked from the most effective control measures to the least effective. By following it, you can ensure you’re choosing the best possible solution, rather than just the easiest one. Regulators expect that same preferred order, and health and safety inspectors will ask why a lower-level option was selected.

The Five Levels of Control

Think of the hierarchy as a pyramid. Your goal is always to move as far up the pyramid as possible.

Level 1: Elimination (Most Effective)

Elimination means completely removing the hazard from the workplace. If you can eliminate the hazard, the risk is gone forever. This is the most effective control because it provides the highest level of protection, and designing a danger out early protects the long-term health of everyone on site.

How to Do It:

• Replace a toxic cleaning chemical with a non-toxic alternative.
• Use a contractor to handle a dangerous task like working at height or in a confined space.
• Stop a specific, high-risk process altogether.

Example:

• Instead of having workers manually lift heavy materials, you eliminate the hazard by installing a forklift or a crane. The need for manual lifting is gone, and so is the risk of back injury.

Level 2: Substitution

Substitution involves replacing a hazardous material or process with a safer one. It doesn’t eliminate the hazard, but it reduces the risk.

How to Do It:

• Replace a solvent-based paint with a water-based one.
• Use a pre-fabricated structure instead of constructing one on-site, which reduces the need for dangerous cutting and welding.
• Swap out a noisy machine for a quieter model.

Example:

• A bakery owner substitutes flour with a low-dust alternative to reduce the risk of a worker developing asthma from prolonged inhalation.

Level 3: Engineering Controls

Engineering controls are physical changes to the workplace, equipment, or process that reduce the risk. These are a strong, reliable form of control because they don’t rely on a person remembering to do something.

How to Do It:

• Install guards on moving machinery parts.
• Use local exhaust ventilation to remove chemical fumes.
• Install a safety rail or fall arrest system on a roof.

Example:

• A workshop installs a ventilation system to extract welding fumes at the source, preventing them from spreading into the air and being inhaled by workers.

Guarding a machine at the design stage almost always costs less than retrofitting protection after an incident.

Level 4: Administrative Controls

Administrative controls are changes to the way people work. This includes procedures, rules, training, and signs. These are less effective than the controls above because they depend on human behaviour.

How to Do It:

• Develop a new Safe Work Method Statement (SWMS) for a high-risk task.
• Implement a roster that limits a worker's time in a noisy area.
• Rotate teams so nobody is working in extreme heat for an entire shift.
• Introduce a workplace bullying policy that sets clear behavioural standards.
• Put up signs warning of a hazard (e.g., "CAUTION: Hot Surface").

Example:

• A company creates a formal lifting procedure and provides training to all staff to reduce the risk of back injuries.

Level 5: Personal Protective Equipment (PPE) (Least Effective)

PPE is a last resort. It's equipment worn by the worker to protect them from a hazard. It is the least effective control because it only protects the individual and does not reduce or eliminate the hazard itself. It also relies on the worker using it correctly, every time.

How to Do It:

• Provide hearing protection like earmuffs in noisy areas.
• Supply safety glasses to protect from flying debris.
• Require steel-toed boots in a construction area.

Example:

• A worker wears safety gloves to protect their hands from chemicals when there is no other practical way to eliminate or substitute the substance.

The Importance of Combining Controls

In many workplaces, a single control measure isn't enough. To achieve a safe outcome, it's often necessary to combine controls from different levels of the hierarchy. For example, a worker might be required to use a quieter machine (Substitution) with an attached safety guard (Engineering), follow a Safe Work Method Statement (Administrative), and wear gloves (PPE).

Where the Hierarchy Sits in Your Safety Management System

Selecting a control is only one part of a wider risk management process. Recording, communicating and verifying that decision turns a sound judgement into lasting protection, and a documented safety management system gives you the framework to do exactly that. The same preferred order applies to noise, manual tasks and the three types of environmental hazards that create long-term risks.

Senior management sets the tone. When leaders fund higher-order fixes rather than defaulting to gloves and goggles, everyone notices. Visible management commitment looks like budget, calendar time and honest follow-up.

Each measure you choose should land somewhere in your documentation. Typical management records include:

• A plant and equipment management register listing guards, isolation points and inspection dates
• Chemical management registers holding Safety Data Sheets alongside ventilation requirements
• Noise management plans covering rosters, quieter models and hearing protection
• Heat and fatigue management arrangements for outdoor crews
• Contractor management packs confirming who performs each high-risk task, and how
• Traffic management plans separating people on foot from mobile plant
• Incident logs and hazard reporting records that feed the next review
• A workplace facility plan mapping amenities, exits and welfare provisions

Review, Verify, Improve

Controls drift over time. A scheduled management review asks three questions: is each measure still in place, still doing its job, and still the best available option? Change management should trigger a fresh assessment whenever new plant, products or personnel arrive.

Ask how your crew is actually working, not how the procedure says they should be. Assign clear management responsibilities so nobody assumes another person is checking, and use line management verification — a short walk-through, a signature, a photo — to close the gap between paperwork and practice. Every change to the working environment deserves that same scrutiny.

Common Mistakes to Avoid

• Jumping straight to protective gear because that route is cheap and fast
• Leaving decisions outside your document management, where nobody can find them
• Treating consultation as optional when the crew knows the task best
• Skipping management oversight of contractors, labour hire and visitors
• Filing a register and never raising it again at your next management meeting

By using the Hierarchy of Controls, you’re not just meeting your legal obligations; you’re making a real, tangible difference to the safety and well-being of your entire team. Good outcomes come from layers of protection, not luck, and layering keeps everyone working safely.

Frequently Asked Questions

Q: Why is PPE the last resort?
PPE is the last resort because it is the least reliable control. It can be uncomfortable, improperly fitted, or simply not used, meaning the hazard still exists and can cause harm.

Q: What is the difference between an engineering and an administrative control?
An engineering control is a physical modification to the workplace or equipment (e.g., a machine guard). An administrative control is a change in a procedure or a rule (e.g., a safety sign or a training program).

Q: Do I have to use the Hierarchy of Controls?
Yes. Under the WHS Act, you must follow the hierarchy and try to eliminate the risk first. If that's not reasonably practicable, you move down the hierarchy.