Estimated Reading Time: 14 minutes
TL;DR: The hierarchy of controls is a five-level framework that ranks hazard controls from most to least effective: elimination, substitution, engineering controls, administrative controls, and PPE. The most powerful controls remove or design out the hazard. The weakest controls rely on people to behave perfectly. NIOSH built the framework, OSHA expects you to follow it, and the safety professionals who use it consistently see fewer injuries, lower costs, and stronger leadership credibility. This guide walks you through every level, where teams misuse it, and how to apply it inside your Safety Management Cycle.
The hierarchy of controls in workplace safety is the single most important framework you will ever use as a safety professional. It tells you which hazard controls actually work…and which ones quietly let people get hurt while looking busy on paper. Most safety programs default to PPE and a training class. That is the fastest path. It is also the weakest path, and it is why injuries keep showing up after you “fixed” the issue.

Table of Contents

Key Takeaways

  • The hierarchy of controls ranks five hazard control methods from most to least effective.
  • Elimination, substitution, and engineering controls work without relying on human behavior. They are always your first targets.
  • Administrative controls and PPE are necessary, but they are weak on their own. They depend on people to follow the rules every single time.
  • Skipping the hierarchy is the most expensive mistake in safety…you trade short-term convenience for long-term injuries.
  • The hierarchy plugs directly into the Develop phase of your Safety Management Cycle.
  • NIOSH publishes the official framework. OSHA’s standards (like 1910.134) explicitly require you to use it.

What Is the Hierarchy of Controls?

The hierarchy of controls is a five-tier framework, developed by NIOSH, that ranks workplace hazard controls from most to least effective. The order matters. Each level above PPE protects more workers, more reliably, with less day-to-day effort. The five levels, in order:
  1. Elimination – physically remove the hazard
  2. Substitution – replace the hazard with something safer
  3. Engineering Controls – isolate people from the hazard
  4. Administrative Controls – change the way people work
  5. Personal Protective Equipment (PPE) – protect the worker as a last resort
Read the official NIOSH framework on the CDC website for the regulatory backbone. The graphic you have probably seen, the inverted triangle, comes straight from NIOSH. Here is the heart of it: the higher you go on the hierarchy, the less you rely on humans to stay safe. Elimination requires zero training, zero compliance, and zero discipline…because the hazard simply does not exist anymore. PPE requires perfect fit, perfect use, perfect maintenance, and perfect compliance every shift. Guess which one fails more often.

Quick Comparison Table

Level What It Does Effectiveness Reliance on Worker Behavior
Elimination Removes the hazard Highest None
Substitution Replaces with safer option Very high Low
Engineering Isolates the hazard High Low
Administrative Changes work practices Moderate High
PPE Shields the worker Lowest Very high

Why the Hierarchy Matters Right Now

Five thousand seventy workers died on the job in 2024 according to the BLS Census of Fatal Occupational Injuries. That is one worker every 104 minutes. Most of those fatalities were preventable. Not by more training, not by more PPE…but by control choices that should have happened months or years before the incident. When a forklift hits a pedestrian, the typical response is “more spotter training” and a yellow vest. The hierarchy says no. You build a separate pedestrian walkway (engineering), restrict forklift hours to off-shift production (administrative… weak but better than nothing), or eliminate the forklift route through the high-traffic area entirely (elimination). That is the difference. And it is also why your insurance carrier, your CFO, and your legal team should care about your hierarchy of controls strategy as much as your operations team does.

Level 1: Elimination

Elimination is the gold standard. You remove the hazard from the workplace, period. No worker exposure, no exposure data, no PPE program required. A few examples I have used with my own teams:
  • Removing a piece of equipment that produced a process we no longer ran
  • Eliminating a manual lift by automating the conveyor handoff
  • Cancelling a chemical that was used “because we always have”
Elimination feels obvious, but most teams skip past it because it is hard. It usually requires capital, leadership buy-in, or a redesign of the process. The reflex is to slap a procedure on top of the hazard instead. Here is my rule: if you have not asked “can we just stop doing this?” first, you have not earned the right to write a procedure. For deeper application, read Elimination and Substitution: The Gold Standard of Hazard Control.

Level 2: Substitution

Substitution is elimination’s cousin. You cannot remove the hazard, so you swap it for something less hazardous. Common substitutions I see in the field:
  • Water-based cleaners replacing solvent-based cleaners
  • LED lighting replacing high-pressure sodium and mercury vapor
  • Smaller container sizes that reduce splash and spill volumes
  • Battery-powered tools replacing pneumatic ones with cord trip hazards
The trap: a “safer” chemical is not always safer. Always check the safety data sheet for the substitute. Always run a small-scale trial before rolling it out facility-wide. Always loop in the people who will actually use it…because a chemical that breaks down equipment is not a substitution win. Substitution and engineering thinking together belong to the hazard elimination methods at the top of the hierarchy. They are the only levels where you can walk away and the hazard cannot hurt anyone.

Level 3: Engineering Controls

Engineering controls put a barrier (physical, distance, or time) between the worker and the hazard. The hazard is still there, but the worker cannot reach it during normal operations. Examples that show up in almost every facility:
  • Machine guarding
  • Local exhaust ventilation
  • Sound enclosures around grinders
  • Interlocked doors on robotic cells
  • Fall protection anchor systems built into the structure
Engineering controls earn their effectiveness from one fact: they do not require the worker to do anything different. The control is just there, working in the background. The downside is they cost money up front. They also need maintenance…a guard that is hanging by one bolt is not a guard, it is a liability. Inspection cycles for engineering controls belong on your preventive maintenance schedule, not just the safety inspection list. For a deeper look at how to design and implement these, read Engineering Controls: Designing Safety into the Workplace Environment.

THE ALL-ACCESS PASS RESOURCE PAGE

Get all the FREE templates, safety management resources, PDFs, spreadsheets, and more...

SEND ME THE LINK

Level 4: Administrative Controls

Administrative controls change the way people work. Procedures, training, signage, work rotation, permits, and scheduling. Common administrative controls:
  • Lockout/tagout procedures
  • Job hazard analyses (JHAs)
  • Safety training programs
  • Permit-to-work systems for hot work, confined space, line breaks
  • Rotation schedules to limit noise or chemical exposure
  • Housekeeping standards
Administrative controls are necessary. You cannot run a workplace without them. But understand the limit: every single one depends on a human reading, remembering, and choosing to follow the rule under pressure. When the production line is down and the supervisor is yelling, the procedure is the first thing that gets shortcut. This is why you cannot stop at administrative controls and call a hazard “fixed.” You also cannot point to your training records as proof of safety. Training is an input, not an outcome. A solid Job Hazard Analysis is the engine behind most administrative controls. It is also where you discover whether you should have used an engineering control instead. For the full breakdown, read Administrative Controls: Developing Procedures and Practices for Safety.

Level 5: Personal Protective Equipment

PPE is the last line of defense…and it is exactly that. Last. Not first. Not “fastest.” Last. PPE shields the individual worker after every other control has been considered, attempted, or rejected. The hazard is still present and still dangerous. The protection only exists if the PPE is the right type, the right fit, and worn correctly for the entire exposure window. The honest truth most safety leaders avoid: PPE compliance is never 100 percent in any real workplace. People take respirators off to talk. They wedge earplugs in wrong, lift their face shield to see better, and share gloves that are sized wrong. Every gap in PPE compliance is a gap in protection. OSHA itself reinforces this. The respiratory protection standard at 29 CFR 1910.134 explicitly requires employers to use feasible engineering controls before relying on respirators. PPE is the legal backstop, not the legal answer. For deeper context on how to use PPE without leaning on it, read Personal Protective Equipment (PPE): The Last Line of Defense.

Where the Hierarchy Fits in Your Safety Management Cycle

The Safety Management Cycle has five phases: Identify, Develop, Implement & Train, Coach & Observe, Analyze. The hierarchy of controls sits squarely inside the Develop phase. Once you have identified a hazard you do not jump to writing a procedure. You walk down the hierarchy:
  • Can we eliminate it?
  • Can we substitute it?
  • Can we engineer it out?
  • Do we need administrative controls to support the engineered control?
  • What PPE do we need as a backstop?
This sequence is what separates a strategic safety program from a reactive one. If your team writes a procedure or specs PPE before they have walked down the hierarchy, you are missing the most important step. For more on how the Safety Management Cycle organizes your work, read Safety Management Systems: Streamlining Processes for Continuous Improvement.

Common Mistakes Safety Professionals Make

I have done enough hazard assessments to spot the patterns. These are the mistakes I see most often. Mistake 1: Picking PPE first because it is fast. The hazard assessment finishes Friday. Monday morning the procurement order goes out. Engineering controls never get evaluated, and six months later someone gets hurt and the report says “PPE was not worn correctly.” Mistake 2: Treating training as a control. Training is part of administrative controls, but it is not a fix on its own. If you are using training to compensate for a missing engineering control, you have built a system that requires perfect human performance. That system will fail. Mistake 3: Stopping at the first control that “works.” Combining controls is normal. A guard plus a procedure plus PPE is a layered defense. The hierarchy does not say “pick one.” It says “start as high as you can, then layer down.” Mistake 4: Ignoring maintenance. An engineering control with no PM schedule degrades. A guard you cannot inspect is not a guard. Build maintenance and inspection cycles in from day one. Mistake 5: Skipping the case study review. Other facilities have already solved your hazard. Look at real-world case studies of the hierarchy of controls before you build something from scratch.

How to Apply the Hierarchy Step-by-Step

Here is the workflow I teach my Safety Leadership Academy students. It works on a single hazard or a full facility-wide assessment. Step 1: Identify the hazard with specifics. Vague hazards produce vague controls. Instead of “noise on the production floor,” document “85 dBA at the operator station of Press 4 during normal run cycle, 8-hour exposure.” Pull a full hazard assessment so you are working from data. Step 2: Ask the elimination question first. Can we stop doing this task? Can we redesign the process? Can we automate it? Most teams skip this step. Do not. Step 3: Look for substitutions. If you cannot eliminate, can you swap? Different chemical, different tool, different equipment, different process route. Step 4: Design engineering controls. Loop in maintenance, engineering, and the people doing the work. The best engineering controls come from the people who run the equipment every day. Step 5: Write administrative controls to support, not replace, your engineered controls. Procedures, training, signage, rotation. These exist to make the engineering controls work. Not to compensate for the absence of one. Step 6: Spec PPE as a backstop. Match the hazard exposure exactly. Verify fit. Build inspection and replacement schedules. Train on use, but more importantly, train on why. Step 7: Document the rationale. Write down what you considered at each level and why you chose what you chose. This is your defensibility document. When OSHA, your CFO, or your insurance carrier asks why you did what you did, your hierarchy worksheet is the answer. Step 8: Review on a cycle. New equipment, new chemicals, new automation, and new ergonomic research can all move a hazard up the hierarchy. Build a re-review every 1-3 years per process or after any major change. This step-by-step approach is also why the hierarchy belongs inside a structured health and safety program rather than as a standalone tool. Prevention through Design (PtD) takes this even further by pushing controls into the equipment design phase, before workers ever encounter the hazard. Read more on the NIOSH Prevention through Design page.

Application Worksheet (Example)

Question Answer for Hot Work Hazard
Can we eliminate? Replace welding job with mechanical fastener — yes for 30% of jobs
Can we substitute? Use lower-temp brazing for 20% of remaining jobs
Engineering controls? Local exhaust at weld station, fire blankets, shielding
Administrative controls? Hot work permit, fire watch, JHA, training
PPE? FR clothing, welding helmet, leather gloves

FAQ

What is the hierarchy of controls in plain terms?

The hierarchy of controls is a ranked list of five ways to control workplace hazards, from most effective to least: elimination, substitution, engineering controls, administrative controls, and PPE. You start at the top and work down, choosing the highest-level control that is feasible. Combining controls across levels gives you the strongest protection.

Who created the hierarchy of controls?

NIOSH (the National Institute for Occupational Safety and Health) developed the hierarchy of controls. It is the official framework used by OSHA, ANSI, and most national and international safety standards. NIOSH publishes the framework and updated guidance on the CDC’s hierarchy of controls page.

Is the hierarchy of controls required by OSHA?

Yes, in spirit and in many specific standards. OSHA’s General Duty Clause requires employers to provide a workplace free of recognized hazards. Specific standards, like the respiratory protection standard at 29 CFR 1910.134, explicitly require feasible engineering and work practice controls before allowing reliance on PPE.

Why is PPE the lowest level?

PPE does not eliminate or reduce the hazard. It only protects the individual worker exposed to the hazard, and only if the PPE is the right type, fits correctly, is in good condition, and is worn properly for the full exposure period. Every gap in any of those conditions is a gap in protection. Higher-level controls protect everyone in the area without depending on individual compliance.

Can I combine multiple levels of the hierarchy?

Absolutely, and you should. Layered defense is a core safety principle. A typical real-world solution might pair an engineering control (machine guarding) with administrative controls (lockout/tagout procedure, training) and PPE (cut-resistant gloves, eye protection). The hierarchy tells you to start as high as feasible, not to pick only one level.

How does the hierarchy of controls connect to risk assessment?

Risk assessment identifies and ranks hazards by severity and likelihood. The hierarchy of controls tells you what to do about the hazards once you have ranked them. Risk assessment is the “what.” The hierarchy is the “how.” Together they form the backbone of any modern safety management system.

What is “Prevention through Design” and how does it relate?

Prevention through Design (PtD) is a NIOSH-led initiative that pushes hazard control decisions upstream, into the design phase of equipment, facilities, and work processes. PtD is the ultimate expression of the top of the hierarchy because it eliminates or substitutes hazards before workers ever encounter them. It is where serious safety leaders are headed.

How often should I revisit my hierarchy of controls decisions?

At minimum, every 1-3 years per process. Sooner if there is a change in equipment, chemicals, layout, staffing, or process. New technology often opens up engineering or substitution options that did not exist when you wrote the original control plan. Build the review into your annual safety plan.

Now It’s Your Turn

The hierarchy of controls is not a poster you hang in the safety office. It is a decision-making framework you use every time a hazard shows up. Start small. Pick one open hazard from your last assessment. Walk it down the hierarchy with your team and document what you considered at each level. You will find at least one missed opportunity higher up the hierarchy almost every time. If you want my full library of templates, worksheets, and the exact tools I use with the safety professionals I coach, grab the All-Access Pass below. Every resource I reference is in there.

Hi, I'm Brye (rhymes with sky)!  I am a self-proclaimed safety geek with two decades of general industry safety experience.  Specializing in bringing safety programs to a world-class level and building a safety culture, I have trained and coached many safety managers, just like you, on how to effectively manage workplace safety in the real world.   I would love to help you too.

Get started with my weekly newsletters:

GET ON THE LIST!