Hierarchy of Controls Explained: 5 Levels Leaders Use

The hierarchy of controls is the order of decision that ranks hazard control from elimination to PPE, so leaders reduce exposure at the source instead of asking workers to carry the risk. It matters whenever a site must choose between redesign, procedure, supervision, or a last-layer barrier.

Across more than 25 years in multinational EHS work, Andreza Araujo has seen the same pattern repeat: controls hold when they change the task, not when they merely describe the task. That is why the hierarchy is a decision rule, not a poster.

Definition

According to CDC/NIOSH, OSHA, and HSE, the hierarchy of controls is the preferred order for managing workplace hazards, and the reason that order matters is that the lower layers depend on people staying consistent in conditions where attention, staffing, and pressure all change. The five levels are elimination, substitution, engineering controls, administrative controls, and PPE. HSE also says PPE is the last resort, which is why the order matters before the crew steps into the field.

A control is strong when it changes the hazard itself, which is why elimination and substitution matter before anything that depends on memory. The supervisor whose crew still relies on notices and reminders is managing behavior, not exposure, and a site where the only barrier is a sign has not really controlled the hazard.

The 5 levels

Elimination

Elimination removes the hazard from the process, which is the cleanest control when redesign is possible. If the hazard never reaches the worksite, the team does not need to remember a workaround or recover from a missed step.

Substitution

Substitution replaces the hazard with something less dangerous, which keeps the work function while lowering exposure. This is still a design decision, and it works best when the replacement does not create a new problem that the team has to chase later.

Engineering controls

Engineering controls isolate people from the hazard with guards, enclosures, interlocks, ventilation, or separation. They matter because they change the system where the risk lives, and they keep exposure low even when the day gets noisy.

Administrative controls

Administrative controls change the way work is scheduled, authorized, or supervised. They are useful, but they depend on execution, which means they should support better controls rather than carry the whole plan.

PPE

PPE protects the worker with equipment, and it still has a place for residual exposure, short tasks, and breakthrough risk. It is the last layer because it does not remove the hazard, and it only works when fit, selection, use, and upkeep all stay right.

How to differentiate in practice

Use 4 quick questions in the field: Can we remove it? Can we replace it? Can we isolate it? Can we reduce exposure before the crew starts? Those questions separate a design answer from a supervision answer, and they show where the next dollar should go.

The table below helps a plant manager, EHS manager, or shift supervisor see the difference in one glance, which is useful when the same hazard keeps returning with a new permit number.

When the answer to every question is a procedure, the control stack is already weak. When the answer includes a physical change, the site is moving in the right direction, because the hazard is becoming harder to reach even if the shift gets rushed.

When the hierarchy is not enough by itself

The hierarchy is not a license to stop after one layer. A good control plan often combines engineering, administrative, and PPE layers while the site works toward a stronger design answer. That is why control review should happen again after the first change, not only after an incident.

If the hazard still depends on a permit, a checklist, or a memory cue, the next review should ask whether the team can move one step higher. The companion article on stored energy that remains after isolation shows why a task can look controlled and still carry hidden exposure.

In practice, leaders who want fewer field surprises should read the hierarchy as an operating sequence, not as a classroom diagram. That is the same logic Andreza Araujo uses in Safety Culture: From Theory to Practice, where control choice is treated as a daily leadership habit.

What leaders miss

Trap 1: treating PPE as the answer.

PPE helps, but it only guards the person wearing it. If the hazard is still open in the area, the organization is managing residual exposure instead of reducing the source of risk.

Trap 2: calling administrative control a design fix.

A rule change can help the crew, yet it still depends on attention, staffing, and supervision. Engineering changes are stronger because they keep the hazard under control when the night shift gets short or busy.

Trap 3: closing the review when the form is complete.

A signed form proves documentation, not exposure reduction. The control only counts when the next walkdown, permit, or maintenance task shows that risk dropped in the place where work actually happens.

If your site still solves hazards with reminders, the better next step is to redesign the task and then verify the new barrier in the field. For deeper support, Andreza Araujo and ACS Global Ventures can help turn the hierarchy into practical operating discipline.