Hazard Control
Hierarchy of Controls Explained: From Hazards to Verified Controls
The hierarchy of controls is a ranking that tells you which type of safety control to try first. It runs from elimination, the most effective, down to PPE, the least. The order matters because controls higher on the list remove risk instead of relying on people to behave perfectly.
By Matthew Hart
CEO, Soter
Written for safety professionals who own the question of whether controls are adequate, verified, and effective.
What the hierarchy of controls is
The hierarchy of controls is the decision rule at the center of every good safety program. Once you have found a hazard, the next question is always the same: what do we do about it? The hierarchy answers that by ranking the types of control from the most effective to the least, so the choice is not left to whoever is closest to the problem on a busy day.
The category that matters here is hazards-to-controls. Finding a hazard is only half the job. The hazard is not closed until a control is assigned, implemented, and verified. The hierarchy is how you pick a control that actually holds, rather than one that looks responsible in a document.
The five levels, from most to least effective
The five levels are elimination, substitution, engineering controls, administrative controls, and personal protective equipment. The order is not a preference. Controls near the top remove the hazard or isolate people from it, so they keep working even when nobody is paying attention. Controls near the bottom depend on a person doing the right thing every single time, which is where real workplaces tend to break down.
1. Elimination
Physically remove the hazard. If a task at height can be done at ground level, the fall hazard is gone, not managed. Elimination is the most effective control because there is nothing left to fail and nothing left to enforce. It is easiest to design in early, when a process or a layout is still on paper, and hardest to retrofit once the line is running.
2. Substitution
Replace the hazard with something less dangerous. Swap a solvent-based cleaner for a water-based one, or a heavy manual part for a lighter design. Substitution keeps the work but lowers its inherent risk. The caution is to check that the replacement does not introduce a new hazard of its own, which is a common trap with chemical substitutions.
3. Engineering controls
Isolate people from the hazard with a physical change to the workplace. A machine guard, local exhaust ventilation, a barrier, or an interlock all sit here. Engineering controls do not remove the hazard, but they put a reliable physical layer between it and the worker, so they do not depend on behavior the way procedures and PPE do.
4. Administrative controls
Change the way people work. Safe work procedures, job rotation, training, signage, and permit systems are administrative controls. They are useful and often necessary, but they rely on people knowing the rule, remembering it, and following it under pressure. That dependence on human behavior is why they rank below engineering controls.
5. Personal protective equipment
Protect the individual worker with equipment: gloves, respirators, hearing protection, eye protection. PPE is the last line, not because it does not matter, but because it only protects one person, only when worn correctly, and only while it is in good condition. PPE is a backstop for residual risk, not a substitute for controlling the hazard further up the list.
It helps to see the five levels side by side. The effectiveness ratings below are from the AIHA Hierarchy of Controls white paper (2024); the ordering and the reasoning behind it come from NIOSH.
| Level | Effectiveness | Depends on human behavior | Cost and effort | Example |
|---|---|---|---|---|
| Elimination | Highest | None, the hazard is gone | Cheapest designed in early, costly to retrofit | Do the task at ground level instead of at height |
| Substitution | Very high | Very low | Low to moderate, easiest at design stage | Water-based ink in place of a solvent-based one |
| Engineering | High | Low once installed, needs maintenance | Higher upfront, often lower to run | Machine guard, local exhaust ventilation, noise enclosure |
| Administrative | Moderately low | High, needs consistent action every shift | Cheap to set up, costly to sustain | Job rotation, training, permit and lockout systems |
| PPE | Lowest | Highest, every worker every time | Cheap per unit, costly to sustain | Respirators, hearing protection, gloves, hi-vis |
The order in one sentence
The higher a control sits, the less it depends on a human being doing the right thing under pressure, and the more reliably it protects people when no one is watching.
Why the order is not a preference
The ranking is not a style choice. NIOSH puts elimination, substitution, and engineering controls at the top for one reason: they "control exposures without significant human interaction." Once a guard is fitted or a hazard is designed out, it keeps working on the night shift, during a rush, and when the most experienced person is on leave. A control that depends on someone remembering a rule does not.
That is also the logic behind NIOSH's Prevention through Design program, which treats designing a hazard out of a process as the most reliable prevention there is, because it removes the risk before anyone is ever exposed to it. The AIHA white paper rates the levels the same way, from elimination as "high" down to administrative controls as "moderately low," with PPE last.
The weakness of the lower controls is human, and it is measurable. PPE only protects when the right equipment is chosen, fits, is worn correctly, and is maintained, on every worker and every shift. Any single miss exposes the person. In one peer-reviewed study of construction workers, roughly 40 percent did not consistently use the PPE their work required (PMC). That is not a knock on workers. It is the predictable result of asking a behavior to hold perfectly, forever, as your primary line of defense.
A worked example: an unguarded conveyor nip point
Suppose a hazard inspection finds an exposed in-running nip point on a conveyor at operator reach. Walk it down the hierarchy and the difference between control levels becomes concrete.
- Elimination: redesign the transfer so the nip point no longer exists. Best outcome, highest effort, usually only possible at design time.
- Substitution: use a different conveyor type without an exposed nip. Possible during a line refit.
- Engineering: fit a fixed guard over the nip point so a hand cannot reach it. Reliable, does not depend on the operator.
- Administrative: add a procedure to keep hands clear and a sign on the machine. Helpful, but only as good as compliance.
- PPE: gloves do almost nothing against a nip point and can make entanglement worse. PPE is the wrong primary control here.
The point of the exercise is that the obvious move, a sign and a reminder, is near the bottom of the list. The control that actually holds is the guard, and the hierarchy is what pushes you toward it.
Two more examples, including one the regulator wrote
The pattern holds across hazards. In the two below, the ranking is not just good practice, it is written into the OSHA standard, so the order is a legal requirement rather than a recommendation.
Noise. For a loud process, the order is not optional, it is written into the standard. OSHA's noise rule sets a permissible exposure limit of 90 dBA over an eight-hour shift and states that "feasible administrative or engineering controls shall be utilized" first, with hearing protection used only if those controls do not bring the level down. So elimination is stopping the noisy process, substitution is quieter machinery, engineering is enclosures and barriers, administrative is rotating people out of the area, and earplugs are the backstop, not the plan.
Forklift and pedestrian. OSHA works this exact scenario in its own hierarchy worksheet. Elimination redesigns the route or automates the delivery so trucks and people never share the space. Engineering separates them with barriers, crossings, and mirrors at blind corners. Administrative adds training, alarms, and scheduling. PPE is a hi-vis vest. The worksheet makes one point worth keeping: a control can create a new hazard. Backup alarms add noise and alarm fatigue, a loose hi-vis vest can be caught by machinery, and a slower substitute truck can raise production pressure. A control is not finished the moment it is added; it has to be checked for what it introduces.
What the regulator actually expects
In the United States, the duty starts above any single standard. The OSH Act's General Duty Clause requires each employer to provide a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." It does not dictate a specific fix. To cite an employer under it, OSHA must show a hazard existed, that it was recognized, that it could cause serious harm, and that a feasible means of abatement existed. In other words, the question an auditor brings is not "did you have a procedure," it is "was there a higher control you could reasonably have used and did not."
Several specific standards hard-code the order so there is no ambiguity. The noise rule above puts engineering and administrative controls ahead of hearing protection. The hexavalent chromium standard requires feasible engineering and work-practice controls to reach the exposure limit before respirators are allowed to make up the difference. The machine guarding standard requires a guard, an engineering control, as the primary protection at a point of operation, not gloves and a warning. Read together, they say the same thing the hierarchy says: reach for the higher control first, and be able to show why a lower one was the most you could do.
Where hierarchy-of-controls programs break down
Knowing the hierarchy is not the same as running it. The failures are consistent, and most of them happen below the level of the diagram.
- Defaulting to PPE. The fastest control to write down is "wear the equipment." It is also the weakest, and the standards treat it as a last resort. Reaching for it first, without showing that elimination, substitution, and engineering were considered and ruled out, is the classic gap an auditor looks for.
- Listing controls without ranking them. A risk assessment that names three controls and lands on PPE, with no evidence that anything higher was weighed, has skipped the actual decision the hierarchy is there to force.
- Controls that are never verified. A guard that is removed for maintenance and not refitted, or a ventilation system that is installed and never inspected, degrades quietly. The AIHA 2024 white paper is blunt that confirming a control works is part of the job, not an extra. OSHA pairs engineering controls with periodic inspection and maintenance for the same reason.
- Not re-checking after a change. Because controls can introduce new hazards, a program that adds a control and moves on, without re-assessing, can trade one risk for another and never notice.
From a ranked control to a verified control
Choosing the right level is necessary but not sufficient. A control only counts when it is in place and confirmed to work. That is the gap most programs fall into: the assessment recommends a guard, the recommendation gets logged, and six months later nobody can say whether the guard was ever fitted or whether it is still there.
Closing that gap means treating every control as something with an owner, a due date, and a verification step. The recurring question a safety professional has to answer is whether controls are adequate, verified, and effective. The hierarchy tells you adequate. Ownership and verification tell you the other two.
Where SoterAI fits
SoterAI is built around the hazards-to-controls loop rather than around forms. When you run a hazard identification or a site audit by describing the area or uploading photos and video, SoterAI surfaces the hazards and ranks the suggested controls by the hierarchy of controls, elimination first and PPE last, so the highest-leverage option is on top instead of buried.
Each control then carries an owner and a due date, and the record builds Risk Intelligence from your own incident, control, and hazard history. Over time that history is what lets you answer whether your controls are holding, because the answer comes from your own record instead of a generic benchmark. The mechanism is the hazards-to-controls loop, and the outcome is a control you can verify rather than assume.
See how SoterAI ranks controls by the hierarchy and tracks each one to verified closure. Read the hazard identification use case.