Hierarchy of Control: What It Is and How to Use It

Reviewed by Phil Pinnington, Head of Audit and Consultancy, British Safety Council

Published: 7 October 2026

What is the hierarchy of control?

The hierarchy of control is a framework for choosing control measures, ranked by how effective and reliable they tend to be. At the top are measures that remove the hazard or change it at source. At the bottom are measures that depend on people doing the right thing every time, such as following a procedure or correctly wearing protective equipment.

The principle is simple: deal with the hazard itself where you can, and protect individual people from it only when you can't. That doesn't make lower-level controls "bad". Procedures, training and PPE are essential in almost every workplace, but they work best as part of a combination, not as the first or only answer.

The hierarchy is used internationally, including in ISO 45001, the international standard for occupational health and safety management systems. In the UK, it reflects the

The five levels of the hierarchy of control

1. Elimination

Elimination means removing the hazard entirely. If the hazard is no longer there, nobody can be harmed by it, and nothing depends on people remembering what to do.

Examples include doing work at ground level instead of at height, or designing out a manual handling task by delivering materials straight to where they're used. It could also mean no longer using a hazardous substance at all.

Elimination is easiest at the planning and design stage, so it's worth asking "do we need to do this at all?" before asking how to do it safely.

2. Substitution

Substitution means replacing something hazardous with something less hazardous. For example, switching to a less harmful chemical, using a water-based product instead of a solvent-based one, or buying materials in smaller, lighter units.

The substitute must be assessed in its own right. Substitution can introduce new hazards. A less toxic chemical might be more flammable, for example, or a lighter material might need more frequent handling. Substitution only counts as an improvement if the overall risk goes down.

3. Engineering controls

Engineering controls physically separate people from the hazard or reduce exposure at source. Examples include machine guarding, local exhaust ventilation (LEV), light curtains, interlocks and lock-off mechanisms, and edge protection for work at height.

They are generally more reliable than the levels below because they are built into the workplace rather than depending on individual choices. But they still need to be maintained and checked, and as the examples below show, they can be bypassed.

4. Administrative controls

Administrative controls change the way work is organised and carried out: safe systems of work, permits to work, training, signage, supervision, job rotation and limits on exposure time.

These measures are essential. Even the best engineering control needs a procedure for using and maintaining it. But administrative controls rely on people knowing, remembering and following the rules consistently, including under time pressure. That's why they sit below the controls that act on the hazard itself.

5. Personal protective equipment (PPE)

PPE is protection worn by the individual: hard hats, safety footwear, gloves, eye and hearing protection, respiratory protective equipment (RPE) and fall-arrest harnesses.

PPE sits at the bottom of the hierarchy because it doesn't remove or reduce the hazard. It only protects the person wearing it, and only if it is the right equipment, fits properly, is in good condition and is worn correctly for the whole time they are exposed. If any of those conditions fails, protection fails with it, and often without anyone noticing.

That's why PPE is described as a last resort. It is often a necessary final layer of protection, but it shouldn't be the first or only control considered.

Why the order of the hierarchy of controls matters

The higher controls generally act on the hazard itself. The lower ones increasingly depend on people behaving consistently.

This scale is a guide, not an absolute. Engineering controls reduce reliance on behaviour, but they don't remove it altogether.

Light curtains and lock-off mechanisms are good examples. Both are reliable engineering controls when used as intended: a light curtain stops a machine the moment someone reaches into a danger zone, and a lock-off prevents a machine being restarted while someone is working on it. But British Safety Council's auditors regularly find these controls bypassed, usually under time pressure or when workers are rushing to finish a job. When that happens, the consequences can be severe.

So the order matters, but no level is self-sustaining. The higher you go, the less protection depends on everyone getting everything right, and whatever level you reach, controls need checking in practice, not just on paper.

The hierarchy of controls in practice: four examples

Elimination: surveying roofs without anyone going up

Roof inspections have often meant sending someone up a ladder or in a mobile elevating work platform (MEWP). That person was exposed to the risk of falling from height or through a fragile roof, and the risk was managed with harnesses and fixed anchor or lifeline systems (PPE).

Today, a drone can produce a full, high-resolution map of the roof without anyone setting foot on a ladder or a roof surface. For the survey itself, the fall hazard has been removed, not just protected against. This is elimination in its clearest form.

The shift has accelerated in recent years as drone technology has become more accessible. In best-practice audits, organisations are now expected to actively look for elimination options like this, rather than defaulting to PPE because "that's how it's always been done".

PPE: when fall-arrest equipment becomes part of the hazard

This example comes from construction in markets where best-practice use of PPE is still developing, including parts of the Middle East, and it shows why PPE sits at the bottom of the hierarchy.

Workers on MEWPs and scissor lifts are often attached to the platform with a fall-arrest lanyard. But auditors repeatedly find fall-arrest lanyards used where there isn't enough clearance below the platform for them to work. A lanyard needs space to deploy and absorb the fall. If the worker is too close to the ground, they will hit it before the fall is arrested. In those situations, restraint equipment that stops the worker reaching the edge at all, or the platform's own guardrails, may be the more suitable control.

There's a second risk: if the platform itself overturns, a worker attached to it can be pulled down or trapped with it.

In both cases, badly specified PPE doesn't just fail to help. It becomes part of the hazard. PPE must be selected by someone competent for the specific task and conditions, and should follow higher-level controls, not replace them.

Manual handling: working through the hierarchy before technique

Manual handling conversations often jump straight to lifting technique. Technique matters, but training is an administrative control: on its own, it doesn't change the load, the task or the environment.

Working through the hierarchy first looks something like this:

• Elimination: can the lift be avoided altogether? For example, by having deliveries made directly to the point of use, or by redesigning the process so items don't need moving.
• Substitution: can the load be made lighter or easier to handle? For example, by ordering materials in smaller bags or units.
• Engineering controls: can mechanical aids take the strain? For example, hoists, trolleys, conveyors, lift tables or vacuum lifters.
• Administrative controls: once the task itself has been improved, training in safe handling, team lifting arrangements, task rotation and rest breaks.
• PPE: gloves or safety footwear where needed. These protect against specific injuries, not against the musculoskeletal strain of the lift itself.

This order mirrors UK manual handling law, which requires employers to avoid hazardous manual handling so far as reasonably practicable, assess what can't be avoided, and reduce the risk of injury.

Our podcast episode From Olympic lifting to safer lifting explores this in more depth, including why technique alone is not enough.

Silica dust: a progression through every level

Respirable crystalline silica (RCS) is released when materials such as stone, concrete, brick and some engineered stone worktops are cut, drilled, ground or polished. Long-term exposure can cause silicosis, an irreversible and potentially fatal lung disease.

Silica control shows how several levels of the hierarchy work together:

• Elimination: avoid generating dust in the first place. For example, by designing work so materials arrive cut to size, or by choosing fixing methods that avoid drilling.
• Substitution: use lower-silica materials or less dusty methods where suitable alternatives exist.
• Engineering controls: use water suppression or on-tool extraction to capture dust at source, with ventilation in enclosed spaces.
• Administrative controls: plan work to limit exposure time and the number of people nearby, use cleaning methods that don't spread dust (avoiding dry sweeping and compressed air), train workers, and provide health surveillance where the risk assessment shows it is needed.
• PPE: suitable RPE, properly selected and face-fit tested, as a final layer of protection, not a substitute for controlling dust at source.

Substances like silica are covered by the Control of Substances Hazardous to Health (COSHH) Regulations. Our guide on how to conduct a COSHH risk assessment explains the process step by step. To find out more about the risks of silica dust and what needs to change, visit our Hidden Hazards campaign.

How to apply the hierarchy of control in a risk assessment

The hierarchy of control is most useful at one specific stage of a risk assessment: deciding what controls are needed once hazards and risks have been identified. Here is a practical way to use it.

1. Be clear about the hazard and who it affects, including people who aren't directly doing the task.
2. Ask the elimination question honestly. Could the task be done differently, by other means, or not at all? Drone surveys show that "how we've always done it" is not a fixed constraint.
3. Work down the levels in order. At each level, ask what is reasonably practicable, and record what you considered and why you did or didn't adopt it.
4. Combine controls where one isn't enough. An engineering control usually needs a procedure for using and maintaining it, training, and sometimes PPE as an additional layer of protection.
5. Check for new hazards introduced by any change, whether it's a substitute material, a new machine or a new way of working.
6. Consult with workers. When introducing control measures it is vital that the workers involved in the activity have been fully consulted. The effectiveness of any control measures relies heavily on workers’ cooperation.
7. Make sure controls work in practice. Check whether engineering controls are being bypassed, procedures are followed and PPE is correctly specified and worn.
8. Review and consult regularly, especially after an incident or near miss, or when new equipment, people or technology make a higher-level control possible.

The hierarchy isn't only for physical hazards. It can also be applied to psychosocial risks such as work-related stress, where higher-level controls often mean changing how work is designed and organised, not just offering individual support. Our article on stress risk assessment shows how the hierarchy of controls applies to these less visible hazards.

Build confidence in assessing and controlling workplace risks

Our online, self-paced Certificate in Risk Assessment gives you a strong foundation in the risk assessment process, from identifying hazards and evaluating risk to using the hierarchy of controls to find opportunities to reduce risk. There are no entry requirements, so it's suitable for anyone who contributes to risk assessments at work.

Find out more about the course

The hierarchy of control and UK law

UK law doesn't set out the five-level hierarchy word for word. But the principles behind it run through health and safety legislation.

Employers have a general duty under the Health and Safety at Work etc. Act 1974 to ensure, so far as is reasonably practicable, the health, safety and welfare of their employees. The Management of Health and Safety at Work Regulations 1999 require them to assess risks, and Regulation 4 requires them to put preventive and protective measures in place on the basis of the general principles of prevention in Schedule 1. These include:

• avoiding risks
• evaluating the risks that cannot be avoided
• combating risks at source
• replacing the dangerous with the non-dangerous or less dangerous
• giving collective protective measures priority over individual protective measures.

The same logic appears in more specific regulations. The Work at Height Regulations 2005 require employers to avoid work at height where possible, then prevent and minimise falls. The COSHH Regulations 2002 require exposure to hazardous substances to be prevented or, where that isn't reasonably practicable, adequately controlled. And the Personal Protective Equipment at Work Regulations 1992 require PPE where risks haven't been adequately controlled by other means.

In other words, the law expects employers to do what the hierarchy describes: deal with risks at source first and rely on individual protection only for what remains.

Sources and further guidance

• Health and Safety Executive: Managing risks and risk assessment at work
• The Management of Health and Safety at Work Regulations 1999, Schedule 1
• British Safety Council: Risk assessment: A complete guide