The Hierarchy of Control
The five-level framework that sits behind every good risk assessment in UK H&S. Work from the top down, only reaching for PPE once everything above it has been exhausted.
What the hierarchy is — and why it exists
The Hierarchy of Control is the ranked list of how to deal with a workplace hazard, ordered from most effective (elimination) to least effective (personal protective equipment). Every credible risk assessment methodology — HSE guidance, CDM regs, ISO 45001 — is built around it.
It exists because not all risk controls are created equal. Guarding a blade physically stops it cutting the operator. A “be careful” sign on the same blade relies on the operator reading, remembering, and obeying it — every time, forever. The hierarchy is a structured way of forcing you to pick the controls that work regardless of human behaviour before resorting to ones that depend on it.
The five levels, from top to bottom
Work your way down. Only drop to a lower level when everything above has been genuinely considered and ruled out with a documented reason.
Elimination
Remove the hazard.The most effective control. If the hazard isn’t there at all, nobody can be harmed by it. Always the first thing to try before sliding down the pyramid.
Substitution
Swap for something less harmful.Replace the hazardous material, tool or process with a less hazardous alternative that still achieves the same outcome.
Engineering Controls
Isolate people from the hazard.Physical design interventions that separate workers from the risk: guards, barriers, interlocks, local exhaust ventilation, sound enclosures, edge protection.
Administrative Controls
Change how people work.Procedures, training, signage, permits, rotations, supervision, safe systems of work. These depend on people remembering and following them — which is why they’re ranked below physical controls.
PPE
Protect the individual worker.Hi-vis, hard hats, gloves, boots, harnesses, respirators, ear defenders. The last line of defence — only ever used once everything higher on the pyramid has been exhausted, not as a first resort.
Worked example — working at height on a flat roof
Here’s how the hierarchy plays out for a single, real-world hazard. Notice how much you’d want to achieve before reaching for the harness.
-
1 · Elimination
Can we remove the need to work at height?
Pre-assemble the panel frames at ground level on a lift platform; lift the complete assembly onto the roof in one piece with a telehandler. Nobody spends prolonged time at height.
-
2 · Substitution
Can we swap the method?
Use a scissor lift or cherry picker instead of ladder access — you’re still at height but inside a stable, enclosed platform with guardrails.
-
3 · Engineering
Can we isolate the worker from the edge?
Install temporary edge-protection scaffolding around the full roof perimeter. Workers are now physically unable to fall off the edge.
-
4 · Administrative
How do we change behaviour?
Working-at-height permit, pre-start briefing, competent supervisor, weather-curtailment policy, rescue plan written and rehearsed.
-
5 · PPE
Final protective layer only.
Fall-arrest harness clipped to a suitable anchor point as back-up if all the above fails. Never the primary control on a 6m fall hazard.
The three mistakes we see every week
Jumping straight to PPE
“We’ll just give them a harness” or “everyone’s got a hard hat”. PPE should be the last control added, not the first. If the risk assessment starts with PPE, the hierarchy has been bypassed entirely.
Confusing admin controls with engineering controls
A sign saying “keep guard in place” is an admin control. A physical interlock that stops the machine when the guard opens is an engineering control. They aren’t interchangeable — the second is dramatically more reliable.
Treating the hierarchy as a pick-one menu
You don’t pick one level and stop. You combine as many layers as are reasonably practicable — engineering + admin + PPE is the standard for genuinely hazardous work. Each layer catches what the one above missed.
The five-question check
Use this on any risk assessment you’re reviewing. If you can’t answer yes to the top questions, the controls aren’t strong enough.
- Can the hazard be removed altogether? (Elimination) — if yes, do that and stop.
- Can the hazard be swapped for a less dangerous alternative? (Substitution) — test the swap for unintended consequences.
- Can we design people out of contact with it? (Engineering) — guards, LEV, isolation, interlocks.
- Can we change how the task is done? (Administrative) — permits, training, rotation, supervision.
- What residual risk is left? (PPE) — this is what the equipment protects against, not the whole risk.