Hierarchy of Controls: The Five Levels, Most to Least Effective

Frameworks in health and safety come and go. This one has lasted the better part of a century, across industries with almost nothing else in common. That is worth understanding.

What is the hierarchy of controls?

The hierarchy of controls, drawn as an inverted pyramid. From most effective at the top: eliminate, substitute, engineering controls, administrative controls, PPE. Effectiveness falls as the control depends more on human behaviour.
The hierarchy of controls. Teal bands are designed-in; purple bands depend on someone getting it right on the day.

The five levels, most effective first:

  1. Elimination. Remove the hazard altogether: design out the task, the substance or the journey.
  2. Substitution. Replace it with something less hazardous: a safer substance, a smaller vehicle, a different process.
  3. Engineering controls. Isolate people from the hazard by design: guards, barriers, local exhaust ventilation, separate routes.
  4. Administrative controls. Change the way people work: procedures, permits, signs, rotas, supervision and training.
  5. Personal protective equipment (PPE). Protect the individual: gloves, hearing protection, high-visibility clothing.

The five named levels come from ISO 45001:2018, clause 8.1.2, which sets the order as a requirement (elimination, substitution, engineering controls, administrative controls including training, then PPE), and from NIOSH in the US, which lists the same five. They are taught in the first week of nearly every safety qualification, NEBOSH and IOSH included. HSE's own guidance follows the same order without numbering it: its first question is "can I get rid of the hazard altogether?", and "providing personal protective equipment and making sure workers wear it" comes last. Some UK courses teach a longer mnemonic, ERIC-PD (eliminate, reduce, isolate, control, PPE, discipline); the logic is the same.

Why is the order the way it is?

Eliminating a hazard works whether or not anyone is paying attention. A guard rail works while someone is tired, distracted, new to the site, or having a difficult day. A procedure works when it has been read, remembered, understood and followed — which is often, but not equally on every shift. PPE works when it is worn correctly, maintained, and to hand at the moment it is needed.

That is not a comment on people. It is a comment on design.

The hierarchy is one of the few frameworks that says plainly: build the control so that it does not need anyone to be at their best.

What is the difference between engineering and administrative controls?

It is the line the whole hierarchy turns on. An engineering control changes the workplace; an administrative control changes what people are asked to do. The first keeps working when nobody is thinking about it. The second works when it is remembered, understood and followed.

Hazard Engineering control Administrative control
Forklifts and pedestrians Physical barrier or a separate walkway Painted walkway, "look both ways" rule
Noise Enclosure or quieter machine Time limits in noisy areas
Dust or fumes Local exhaust ventilation Work rotation, permit to work
Moving machinery Fixed guard with interlock Safe system of work, training

A quick test: if the control would still work on a night shift staffed by someone who started yesterday, it is probably engineering. If it depends on that person knowing the rule, it is administrative. Both are real controls; the hierarchy says which one can carry more weight.

What does the hierarchy look like for vehicles and pedestrians?

Workplace transport is where the hierarchy is easiest to see, because HSE's own guidance follows it closely. Taking HSE's A guide to workplace transport safety (HSG136) and the forklift code (L117) level by level:

Level Vehicles and pedestrians, in HSE's words
Eliminate Design out the meeting. "Removing the need for reversing is the most effective" way to control reversing risk (HSG136), through drive-through layouts and one-way routes. "Where possible, prohibit pedestrians from areas where lift trucks are operating" (L117).
Substitute Change the activity or its timing so fewer people and vehicles meet, for example by limiting vehicle movements on a roadway "during a shift changeover, when many pedestrians are likely to be crossing" (HSE).
Engineering Segregation, "preferably by making routes entirely separate", which HSG136 calls "the most effective way of protecting" pedestrians: footbridges, barriers, raised kerbs. Fixed traffic calming, not just a sign, to control speed.
Administrative Marked walkways and crossings, speed limits, site rules, induction for visiting drivers, and banksmen, whom HSG136 says to use "only when all other options have been exhausted".
PPE High-visibility clothing: worth having, and the last line, not the first.

Placing "change the timing" under substitution is our reading; HSE does not label its controls by level. The order, though, is HSE's throughout: separate first, signs and people last.

A painted walkway asks everyone, on every shift, to choose not to meet the forklift. A barrier does not ask.

A mix is normal, and a marked walkway is a real control. It is also the one worth checking most often, on the shifts nobody walks. Our guides on checking pedestrian segregation, writing a traffic management plan and what to do after a forklift near miss take each level further.

So why do most corrective actions end in a briefing?

Because working up the hierarchy is not simply a matter of deciding to.

A toolbox talk can be arranged for Tuesday. It takes an hour. It leaves an attendance record — something an auditor, an insurer or a board can be shown.

Segregating vehicles from pedestrians takes capital, design work, downtime and a conversation with operations about throughput. It may take a year, and for most of that year there is nothing to show.

So the safety professional recommending the briefing is usually not choosing the easy option over the right one. They are working inside a budget cycle and an audit calendar, getting a real control in place this week rather than a better one possibly next year. That is a reasonable judgement, made in good faith, thousands of times a day.

The hierarchy is not a scolding. It is a way of knowing how much weight a control can carry before you rely on it.

What did the major thinkers add?

Timeline of safety thinking: Heinrich 1931, first systematic study of accident causation; Reason 1990, latent conditions versus active failures; Rasmussen 1997, drift toward the safety boundary; Hollnagel 2014, Safety-II and how work goes right.
Ninety years of refinement — each one widening the lens from the person to the conditions around them.

Heinrich (1931) gave the field its first systematic look at accident causation, at a time when almost nobody was collecting data at all. The discipline exists in its modern form partly because someone thought to count.

Reason (1990) separated active failures — what happened at the sharp end — from latent conditions, the upstream decisions that shaped what was possible. Investigations naturally find the visible, recent thing. The more durable findings usually sit further back.

Rasmussen (1997) added time. Organisations adapt, which is a strength — but under steady pressure to be efficient, practice migrates toward the edge of the safe operating space in small, locally sensible steps. A barrier that has been removed is obvious. A practice that has quietly evolved looks much like the one that was written down.

Hollnagel (2014) reframed what we measure. Safety-I is the absence of things going wrong. Safety-II is the presence of things going right — the shifts that went well, and why.

None of this overturns the hierarchy. All of it explains why the hierarchy is right.

Does culture change what a control is worth?

Yes, and it is worth saying plainly.

A written procedure carries different weight on a site where people feel able to stop the job than on one where they do not. A near-miss system reflects how safe it feels to report. Shift patterns, language, contractor mix, how long people have worked together — all of it changes what a level-four control is actually worth on a given Tuesday.

That is not a reason to be pessimistic about administrative controls. It is a reason to look at the site in front of you rather than the one in the textbook, and to ask the people who do the work what would genuinely help.

How do you tell if a control is strong enough?

One question, and it can be asked without blaming anyone:

If the person doing this had a genuinely difficult day — tired, rushed, covering for a colleague, new to the site — would this control still hold?

If yes, it is probably an engineering control or better. If it depends on them remembering the briefing, it is a level-four control doing its honest best. That is not a failing. It is information, and it is useful when deciding where the next pound and the next hour should go.

Where this is heading

The encouraging part is that the profession is already moving this way. Learning teams, human and organisational performance, Safety-II thinking, the growing interest in leading rather than lagging indicators — all versions of the same shift: from asking why something went wrong to asking how the work actually happens, and designing from there.

What has changed most recently is not the principle but the visibility. It has always been hard to see how work is really done across a whole site, on every shift, over months. The more clearly we can see that, the easier it becomes to find the conditions worth changing rather than the moments worth correcting.

The hierarchy of controls has been right since it was written down. Whether the chosen control is still standing is a separate question, the one the Check stage exists to ask. It has simply been asking for something the field is now much better equipped to give it.

Read next

Common questions

What is the hierarchy of controls?

A ranking of five ways to deal with a workplace hazard, ordered from most to least effective: eliminate, substitute, engineering controls, administrative controls, and personal protective equipment. The five levels are set out in ISO 45001:2018, clause 8.1.2, where the order is a requirement, and by NIOSH. HSE's guidance follows the same order, starting with getting rid of the hazard and ending with PPE.

Why is elimination ranked above PPE?

Because the order tracks how much each control depends on a person doing the right thing at the moment it matters. An eliminated hazard cannot hurt anyone whether or not attention is being paid. PPE only protects if it is worn correctly, maintained and to hand.

Why do so many corrective actions end in retraining?

Administrative controls are quick, affordable and leave an evidence trail — a briefing can happen this week and produces an attendance record. Engineering controls need capital, design work and downtime, and may take a year with nothing to show in the meantime. It is usually a constraint, not a preference.

What is the difference between Safety-I and Safety-II?

Erik Hollnagel's distinction. Safety-I measures the absence of things going wrong — injuries, lost time, days since the last incident. Safety-II looks at the presence of things going right: the many shifts that went well, and the conditions that made them go well.

Are administrative controls bad?

No. They are a real control and often the right one available at the time. The hierarchy simply indicates how much weight a control can carry, which is useful information when deciding where the next pound and the next hour should go.

Which control in the hierarchy is most effective?

Elimination, because the hazard no longer exists, so nobody has to do anything right for it to work. Substitution comes next, then engineering controls. Administrative controls and PPE are the least effective, with PPE last, because they rely on people's behaviour every time.

Where does PPE sit in the hierarchy of controls?

At the bottom, as the last resort. PPE protects only the person wearing it, and only when it is the right equipment, fits, is maintained and is worn correctly. It is used when the risk cannot be adequately controlled by the levels above, or alongside them.

Is training an administrative control?

Yes. ISO 45001:2018, clause 8.1.2, places administrative controls, including training, fourth in the hierarchy. Training, procedures, signs, permits and supervision all change what people do rather than the workplace itself, so they sit below engineering controls.

What is an example of the hierarchy of controls for vehicles and pedestrians?

Eliminate: design out reversing with drive-through layouts, and keep pedestrians out of areas where forklifts operate. Substitute: change the timing, for example by limiting vehicle movements during shift changeover. Engineering: separate routes, barriers, footbridges and fixed traffic calming. Administrative: marked crossings, speed limits, site rules and, as a last resort, banksmen. PPE: high-visibility clothing. HSE's workplace transport guide (HSG136) puts segregation first.

References

Published 25 September 2026 · Last updated 25 September 2026

This piece starts from the ideas set out in How We Think About Safety.

Wondering what a camera would see at your gate? Request a Safety Mapping — one camera, two weeks, at no cost.