Hierarchy of Controls vs ALARP vs Inherently Safer Design: Which Lens Should Guide a High-Consequence Design Decision?

A design team can say that a risk is controlled while still debating the most important question, which is whether the hazard should have been designed out before anyone had to manage it in the field. That disagreement often appears when an engineering option, a legal duty, and a residual-risk decision are being discussed in the same meeting.

The hierarchy of controls, ALARP, and inherently safer design do not answer the same question. The hierarchy ranks the relative strength of controls. ALARP asks whether further risk reduction is reasonably practicable. Inherently safer design asks whether the process or equipment can be changed so the hazard is smaller by nature. The best lens depends on the decision that remains open, not on which framework is most familiar.

Key Takeaways

• The hierarchy of controls is the clearest first screen when leaders need to compare elimination, engineering, administrative, and personal protective controls.
• ALARP is a residual-risk decision test. It helps leaders explain why additional reduction is or is not reasonably practicable after safeguards have been considered.
• Inherently safer design belongs early in concept selection because it changes the hazardous material, energy, inventory, intensity, or process condition itself.
• A project can satisfy an administrative control requirement while still missing a design opportunity that would remove the exposure.
• High-consequence decisions should use all three lenses in sequence when the design is still flexible, then document the evidence behind the remaining risk.

What decision is the team actually trying to make?

Before comparing the three lenses, define the unresolved decision in one sentence. A team that is choosing between a smaller chemical inventory and a larger inventory with additional detection is making a design decision. A team that is deciding whether a residual risk can be accepted after safeguards are specified is making an ALARP decision. A supervisor who is choosing between guarding, procedure, and PPE is applying the hierarchy of controls to an operating exposure.

This distinction matters because a familiar framework can pull the discussion toward the wrong level. If the project is already asking which glove or permit is required, the group may have moved too quickly past equipment layout, energy isolation, or material substitution. Andreza Araújo’s Safety Culture: From Theory to Practice treats culture as something revealed by repeated decisions, so the quality of this early design conversation matters more than the polished language in the final procedure.

Write down the decision owner, the hazard, the exposed population, the phase of the lifecycle, and the point at which the option can no longer be changed cheaply. That short record creates a boundary around the comparison and prevents three different questions from being blended into one approval.

How does the hierarchy of controls help?

The hierarchy of controls is strongest when the team needs to compare control effectiveness for a known hazard. The National Institute for Occupational Safety and Health describes the sequence from elimination and substitution through engineering controls, administrative controls, and personal protective equipment. Its practical value is not the diagram alone. The value comes from asking why the chosen control sits where it does and what would be required to move the decision upward.

Elimination removes the hazard. Substitution replaces it with a less hazardous option. Engineering controls separate people from the hazard without depending entirely on individual action. Administrative controls change work instructions, scheduling, training, or supervision, while PPE places more dependence on selection, fit, use, inspection, and maintenance.

The hierarchy does not mean that every lower-level control is unacceptable. A respirator may be necessary while an engineering project is designed, and an operating procedure may still be needed after a guard is installed. The question is whether the organization has treated a lower-level measure as the final answer when a higher-level option was still available.

Use this lens when the team needs to rank options, expose control dependence, or explain why a design should not rely on worker memory under pressure. It is less useful by itself when the central question is whether the residual risk has been reduced as far as reasonably practicable.

How does ALARP change the conversation?

ALARP, which means as low as reasonably practicable, is a decision principle for residual risk. UK Health and Safety Executive guidance describes the balance as requiring risk reduction unless the additional sacrifice in time, trouble, or money is grossly disproportionate to the benefit gained. The phrase does not mean that a cheap control is always enough, nor does it mean that a project can reject a safeguard by saying that the risk is already low.

The discipline of ALARP is evidential. The decision owner should identify the additional measure, the risk reduction it is expected to provide, the resources it would require, and the reasons for accepting or rejecting it. A statement such as “not reasonably practicable” is incomplete unless the organization can show what was considered and why the balance was reached.

ALARP is especially useful after the hazard and candidate controls are visible. It gives leaders a way to discuss residual exposure without pretending that every risk can be reduced to zero. It also makes weak economic arguments easier to challenge, because the comparison must address the scale of the potential harm and the reliability of the proposed safeguard.

Use ALARP when the design authority must justify a remaining risk, when options have different burdens, or when a regulator, board, or workforce representative needs to understand how the decision was made. Do not use it as a shortcut for avoiding elimination or substitution during concept design.

What does inherently safer design add?

Inherently safer design changes the hazardous condition rather than adding layers around it. The classic design principles associated with Trevor Kletz are to minimize the amount of hazardous material or energy, substitute a less hazardous material, moderate the process conditions, and simplify the design so fewer failures can produce harm.

Consider a hypothetical process that uses a large inventory of a toxic substance. A detection system, respiratory protection, emergency response plan, and evacuation procedure may all be valuable, yet the stronger design question is whether the inventory can be reduced, the substance changed, or the operating temperature and pressure moderated. Those changes can remove dependencies that no alarm or training program can fully eliminate.

Inherently safer design is most powerful before equipment is purchased, piping is fixed, or the operating envelope becomes politically difficult to change. Its weakness is that it can be ignored when the project team treats safety as a separate review performed after the commercial and technical choices are settled.

Use this lens during concept selection, process development, layout review, procurement, and major modification. It should also return during management of change when a temporary modification or production request alters the original hazard profile.

Where do the three lenses overlap?

The lenses overlap because each can expose a different weakness in the same proposal. Inherently safer design may reveal that the hazardous inventory can be reduced. The hierarchy of controls can then test whether the remaining exposure is separated through engineering rather than left to procedure. ALARP can document why the final combination is sufficient or why an additional measure remains necessary.

They should not be treated as competing brands. The hierarchy describes relative control strength. Inherently safer design searches for a change in the source of danger. ALARP explains the decision about further reduction once the available options and their evidence are visible.

James Reason’s work on organizational accidents supports this layered reading, because serious harm can emerge when several defenses contain small weaknesses. A design review that considers only the last visible barrier may miss the latent condition that made the barrier necessary in the first place.

Which lens should guide a high-consequence design decision?

The practical sequence is simple enough to use in a gate review. Start with the source of danger, test the remaining controls by their position in the hierarchy, and then make the residual-risk decision with an ALARP record. If the team starts with the last step, it may create a defensible explanation for a design that was never properly challenged.

How should leaders apply the comparison in a project review?

Ask the design team to bring at least one option that removes or reduces the hazard at source, one option that relies on engineering separation, and one option that depends mainly on administrative action or PPE. The point is not to force a predetermined result. The point is to make the trade-off visible while the project can still respond to it.

For each option, record the exposed population, credible high-consequence outcome, initiating conditions, critical controls, human dependencies, inspection burden, and expected change in risk. A useful review also identifies which assumptions come from a standard, which come from a supplier, and which still need field validation.

When the remaining choice depends on cost or schedule, separate those constraints from the safety evidence. The project may still select the lower-cost option, but the decision owner should be able to explain what additional risk remains, which control protects against it, and what evidence would trigger another review.

Andreza Araújo’s work across more than 250 cultural transformation projects is relevant here only as an authority anchor for the broader principle that people read safety through repeated decisions. The design review should therefore end with an operating commitment, not only an approval signature. Someone must own verification after commissioning, when production pressure and real work begin to test the assumptions.

What should be documented before approval?

The record should state the hazard, the decision owner, the options considered, the reason a source reduction option was accepted or rejected, the control hierarchy for the remaining exposure, and the ALARP reasoning for any residual risk. It should also name the assumptions that require verification during commissioning, startup, or the first operating period.

A strong record does not need to be long. It needs to be specific enough that a different leader can understand what was known, what was uncertain, and what would change the decision. That standard is consistent with the principle in The Illusion of Compliance, an English gloss of Andreza’s Portuguese work, that documented conformity is not proof that the system is protecting people in practice.

Schedule a follow-up when the design reaches the field. A control that looked independent on paper may depend on access, maintenance, alarm response, staffing, or contractor coordination. Verification closes the distance between a designed safeguard and a safeguard that actually works under operating conditions.

FAQ

A high-consequence design decision is stronger when the team first asks whether the hazard can be made smaller by nature, then chooses dependable controls for what remains, and finally documents why the residual risk is reasonably practicable. For more guidance on safety culture and leadership decisions, visit Andreza Araújo’s safety culture resources.