Hierarchy of Controls: The Pyramid, Examples, and How to Apply It

Reaching for PPE first feels like the fastest way to protect a worker. It's actually the least reliable one. Because PPE sits at the bottom of the hierarchy of controls. It doesn't remove the hazard; it just puts a thin, fallible barrier between the worker and it. One that only works if the right gear is selected, fitted, worn correctly, maintained, and never fails, for every worker, every time.

The hierarchy of controls exists because some ways of managing a hazard work regardless of human behavior, while others depend on someone remembering to use them correctly every single time.

This article covers every level of the hierarchy, real examples at each one, the genuine difference between the US and Australian models, and how to actually apply it rather than just knowing it exists.

Key takeaways

• The hierarchy of controls ranks hazard control methods from most to least effective: elimination, substitution, engineering controls, administrative controls, and PPE.
• The US NIOSH model uses five levels. Australia's WHS regulations name six control measures across Regulations 35 and 36 but only four ranked steps, with substitution, isolation, and engineering controls sitting at the same level.
• PPE sits at the bottom of the hierarchy, not because it doesn't work, but because it depends entirely on correct, consistent human use.
• The hierarchy isn't legally mandatory as a single blanket rule, but specific standards do require it. OSHA's respiratory protection standard (1910.134) makes engineering-controls-before-respirators binding for airborne contaminants, and Australia's WHS Regulations make the minimisation sequence a legal duty. ISO 45001 goes further: clause 8.1.2 makes the full hierarchy a "shall."
• The same hierarchy now applies to psychosocial hazards in some jurisdictions, not just physical ones.

What Is the Hierarchy of Controls?

The hierarchy of controls is a framework for ranking hazard control methods by how effective they actually are, not by how easy or cheap they are to implement. It's usually drawn as an inverted pyramid or triangle, with the most effective method at the top.

Selecting a control only happens once a hazard has already gone through risk assessment, which is where severity and likelihood get evaluated before a control gets chosen.

The core logic is simple. A control that removes the hazard entirely protects every worker automatically. A control that depends on a worker wearing something correctly, every shift, protects only as reliably as that worker's behavior does.

Where Did the Hierarchy of Controls Come From?

There's no single foundational document. The earliest documented references to a ranked hierarchy of hazard controls date to the early 1950s, with the National Safety Council among the organizations describing an early version.

A historical survey of the literature found dozens of published hierarchies from 1953 onward, varying in form from three to six elements, developed by consensus across different organizations rather than from one original source.

The OSH Act of 1970 doesn't contain a hierarchy of controls. OSHA's regulatory use of the concept came later, embedded piecemeal into specific standards rather than adopted wholesale as law, which is covered in more detail in the OSHA section below.

The National Institute for Occupational Safety and Health extended the framework's reach with its 2007 Prevention through Design initiative. This pushed elimination and substitution earlier, into the design phase of a process, rather than treating them as fixes applied after a hazard already exists.

Prevention through Design isn't a separate tier on the hierarchy. It's a philosophy for applying the top two tiers as early as possible.

The Five Levels of the Hierarchy of Controls

Elimination

Elimination removes the hazard completely. If the hazard doesn't exist, no control measure is needed at all, and no worker can be exposed to it regardless of behavior or equipment failure.

This is the most effective level precisely because it requires nothing further from anyone. A hazardous task that's been eliminated stays eliminated without ongoing maintenance or supervision.

Substitution

Substitution replaces the hazard with something less dangerous. A toxic solvent swapped for a water-based alternative is a classic example.

Substitution needs careful review before it counts as genuine improvement. A replacement that introduces a new, different hazard, or that reacts badly with something already in use nearby, isn't a real substitution. It's just a different problem.

Engineering Controls

Engineering controls physically separate people from a hazard, without requiring a behavioral choice from the worker. Ventilation systems, machine guarding, and noise barriers all fall into this category.

These controls protect everyone in the area automatically, which is why they rank above administrative controls and PPE. A guard on a machine works the same way whether the operator remembers to think about it or not.

Administrative Controls

Administrative controls change how work gets done, rather than the hazard or the environment itself. Job rotation, warning signage, and safe work procedures all sit at this level.

This tier depends heavily on consistent human behavior. A procedure only protects a worker if it's actually followed correctly, every time, which makes it inherently less reliable than the three tiers above it.

It is worth noting that this isn't universal even within OSHA's own standards. The noise standard (1910.95(b)(1)) lists administrative controls ahead of, and co-equal with, engineering controls, rather than ranking one strictly above the other, the same exception the OSHA section later in this article covers in more depth.

Personal Protective Equipment (PPE)

PPE is the last line of defense, used when higher-level controls can't fully eliminate a hazard on their own. Hard hats, gloves, respirators, and safety glasses all belong here.

PPE sits at the bottom for a specific reason, not because it's ineffective, but because it protects only the individual wearing it, and only if it's worn, fitted, and maintained correctly. A single missed step, a loose strap, an expired cartridge, an unworn glove, removes the protection entirely.

Hierarchy of Controls Examples

A single hazard often needs controls from more than one level at once, and working through one example end-to-end shows how that layering actually plays out in practice.

Take a workshop that currently uses a solvent-based paint requiring manual spray application.

At elimination, the question is whether the painting step can be removed from the process entirely, perhaps by sourcing pre-finished parts instead.

If that's not feasible, substitution comes next: replacing the solvent-based paint with a water-based formulation that carries a lower toxicity profile.

If some solvent exposure remains unavoidable even after substitution, engineering controls step in: installing a spray booth with local exhaust ventilation to capture overspray and fumes at the source, rather than letting them disperse into the room.

Even with a booth in place, administrative controls add another layer, limiting how long any one worker spends spraying per shift and rotating the task among the team to cap individual exposure time.

Finally, PPE covers whatever risk is still left over: a properly fitted respirator and gloves for the worker actually holding the spray gun, worn because the first four tiers, however well implemented, don't eliminate every last trace of exposure.

Notice what changes at each step. The first two tiers remove the hazard's source; the third contains what's left; the fourth limits how much any individual is exposed to it; the fifth protects the individual directly. None of these five decisions happened at random; each one only became necessary because the tier above it couldn't fully resolve the risk on its own.

Is It Five Levels or Six? US vs. Australian Models

The six-level Australian pyramid is one of the most repeated myths in safety content, and it's worth reading the actual regulation rather than the summary that circulates.

The US NIOSH model uses five levels: elimination, substitution, engineering controls, administrative controls, and PPE, ranked in that strict order.

Australia's model WHS Regulations don't work the same way, and they don't rank six tiers either. Worth noting up front: these are the model WHS Regulations, adopted by every Australian jurisdiction except Victoria, which runs its own Occupational Health and Safety Act 2004 instead.

Elimination sits in its own separate regulation, Regulation 35(a), which requires a duty holder to eliminate risks so far as is reasonably practicable, before Regulation 36 even comes into play.

Regulation 36 itself sets out what happens if elimination isn't reasonably practicable, and it contains three ranked steps, not five or six:

• Regulation 36(3): the duty holder must minimise the risk by doing one or more of the following: substituting the hazard, isolating the hazard, or implementing engineering controls. These three sit at the same level, offered as alternatives to each other, not as a ranked sequence where isolation sits above engineering controls or below substitution.
• Regulation 36(4): if a risk then remains, administrative controls must be applied.
• Regulation 36(5): if a risk then remains, PPE must be used.

A note attached to the regulation makes clear that a combination of these controls can be used together, rather than requiring a duty holder to work through them as mutually exclusive options.

So the accurate count is six named control measures (elimination, substitution, isolation, engineering, administrative, PPE) spread across two regulations, but only four genuine ranked steps: eliminate, then minimise via substitution/isolation/engineering as co-equal alternatives, then administrative, then PPE. Isolation is not a separate tier ranked above engineering controls, the way it's frequently described. It's one of three equally weighted options at the same stage.

How the Major Frameworks Compare

No framework here is more correct than another. Each reflects a different regulatory or standards body's approach to the same underlying idea, covered in more depth in WHS risk management guidance for Australian workplaces specifically.

OSHA's Hierarchy of Controls

OSHA endorses the hierarchy as recommended practice, and makes fragments of it enforceable inside specific standards. But no single rule makes the five-tier sequence mandatory.

The General Duty Clause doesn't reference it at all: Section 5(a)(1) requires only a workplace "free from recognized hazards," with no mention of controls or their ordering. The requirement instead lives inside individual standards.

The respiratory protection standard, 1910.134(a)(1), is a clear example. It requires atmospheric contamination to be prevented "as far as feasible" by engineering controls, and permits respirators only when those controls aren't feasible, or while they're being put in place.

This makes engineering-controls-before-respirators legally binding for that specific hazard category, even though no single OSHA rule states it as a universal requirement for every hazard a workplace might face.

The same engineering-controls-first logic appears in the lead (1910.1025), silica (1910.1053), bloodborne pathogens (1910.1030), and methylene chloride (1910.1052) standards. Each is feasibility-limited and hazard-specific.

And 1910.95(b)(1) is worth a closer look because it requires "feasible administrative or engineering controls," listing them as co-equal. An OSHA standard that treats the two tiers as interchangeable is a useful reminder that the hierarchy is a ranking of general reliability, not a rule that survives contact with every hazard intact.

ISO 45001 takes a firmer stance than any individual OSHA standard does. Clause 8.1.2 of ISO 45001:2018 requires organizations to eliminate hazards and reduce risk using the hierarchy of controls, presenting elimination, substitution, engineering controls, administrative controls, and PPE as a mandatory sequence to work through, not a recommended practice.

Unlike OSHA's piecemeal, hazard-by-hazard approach, an organization certified to ISO 45001 has committed to applying the full five-tier hierarchy as a "shall" requirement across its management system generally, not just for the specific hazard categories OSHA happens to regulate this way.

NIOSH's Hierarchy of Controls

NIOSH maintains the most widely referenced version of the hierarchy as a research-based framework for hazard prevention, distinct from OSHA's role as the regulatory enforcement body. NIOSH's Prevention through Design initiative extended the framework's reach, encouraging elimination and substitution to be considered at the design and planning stage of a process, not just after a hazard is already in place.

The NIOSH Engineering Controls Database catalogs published research on specific engineering control solutions across industries, though its pages haven't been substantively updated since 2018.

How to Implement the Hierarchy of Controls

1. Identify the hazard clearly, using proven hazard identification methods, before selecting any control at all.
2. Start at the top of the hierarchy, asking first whether the hazard can be eliminated entirely, not whether PPE is available.
3. Work down the tiers only as needed, moving to substitution, isolation, or engineering controls only once the tier above has genuinely been ruled out, not skipped for convenience.
4. Weigh cost and feasibility honestly at each tier, rather than treating cost as a reason to skip straight to a lower tier. In Australia, this is the exact test SFAIRP sets out: a higher-level control only gets excused on cost grounds when that cost is grossly disproportionate to the risk, not simply because it costs more than PPE.
5. Combine controls where appropriate. Most real hazards get layered protection from more than one tier, not a single control alone.
6. Document the reasoning, especially when a higher-level control was considered and rejected on cost or feasibility grounds. Risk management software that records this reasoning against each hazard makes it retrievable later, rather than living only in one person's memory.
7. Consult workers directly. The people performing the task usually understand a control's practical viability better than anyone reviewing it from outside.
8. Review control effectiveness regularly, since a control that worked when implemented can become inadequate as equipment, processes, or staff change. Audit and inspection software that schedules this review automatically catches drift before an incident forces the review instead.
9. Revisit the hierarchy after any incident or near miss, checking whether a higher-level control could have prevented it, rather than simply reinforcing the existing PPE requirement.

Hierarchy of Controls for Psychosocial Hazards

The hierarchy of controls isn't limited to physical hazards anymore, though the version applied to psychosocial hazards is a simpler, modified structure, not a direct copy of the five- or six-tier physical model.

Victoria's Occupational Health and Safety (Psychological Health) Regulations 2025 (SR 103/2025, in force 1 December 2025) apply an eliminate-first duty to psychosocial hazards, but it's worth flagging that Victoria isn't a WHS jurisdiction. It runs its own Occupational Health and Safety Act 2004 rather than the model WHS Act these regulations sit under, the same distinction covered earlier regarding Victoria's non-harmonised status.

Regulation 15(1) requires elimination first, matching the physical hierarchy's top tier. Where elimination isn't reasonably practicable, Regulation 15(2) doesn't offer the substitution, isolation, or engineering-controls ladder the physical model does. Instead, it gives just two options: altering the work itself (management of work, plant, systems of work, work design, or the workplace environment), or using information, instruction, or training.

The "predominant control measure" rule has a specific condition attached, not a blanket ban. Regulation 15(3) allows information, instruction, or training to be used on its own, exclusively, only where altering the work genuinely isn't reasonably practicable. Regulation 15(4) only comes into play when both options are combined: in that case, training cannot be the predominant measure in the mix. A program built mainly on awareness sessions, with only token changes to how work is actually managed, doesn't satisfy Regulation 15 even if training was technically included alongside something else.

This still reflects the physical hierarchy's core principle in miniature: a control that depends on individual behavior is treated as weaker than one that changes the underlying condition itself. It's just built on a two-option ladder specific to psychosocial risk, not a transplant of the five- or six-tier physical structure.

What the Hierarchy Actually Asks You to Prove

The hierarchy of controls isn't a checklist to work through once and file away. It's a standard you have to be able to defend, showing why a lower-tier control was genuinely the right call rather than the easiest one.

That's where most of the confusion covered in this article actually causes damage in practice. A business that assumes the US five-tier model applies everywhere, or treats Victoria's psychosocial rules as a copy of the physical hierarchy, or skips straight to PPE because a higher-tier control looks expensive, isn't just getting the theory wrong. They're building a control decision that won't hold up if a regulator, insurer, or court ever asks for the reasoning behind it.

EHS software that records which tier was applied to each hazard, and why the tiers above it weren't used instead, turns that reasoning into something a business can actually produce on demand, rather than something that only existed in one person's head at the time the decision was made.

Frequently Asked Questions

What Is the Least Effective Control on the Hierarchy?

PPE is the least effective control on the hierarchy, sitting at the bottom of both the five-level and six-level models. It protects only the individual wearing it, and only when used correctly every time.

Can You Skip Straight to PPE?

No, skipping straight to PPE without genuinely considering higher-level controls goes against how the hierarchy is meant to work. Some standards, like OSHA's respiratory protection rule, make this a binding requirement rather than just a recommendation.

Is the Hierarchy of Controls Legally Required?

Not as one single blanket rule, but specific standards do make it binding. OSHA's respiratory protection standard and Australia's WHS Regulation 36 both require the sequence to be followed for their specific scope, rather than treating PPE as an equal, interchangeable option.

What's an Example of a Hierarchy of Controls in Construction?

A construction example might start with eliminating a fall hazard by redesigning a task to be done at ground level, substituting a lighter material to reduce manual handling risk, installing guardrails as an engineering control, scheduling task rotation as an administrative control, and issuing a harness as PPE for any residual risk.

What Is the Difference Between Isolation and Engineering Controls?

Isolation physically separates a hazard from workers, such as storing chemicals in a locked, separate room. Engineering controls modify the hazard or environment directly, such as installing ventilation. Australia's WHS regulations name isolation separately but place it at the same level as engineering controls, as alternatives; the US NIOSH model folds isolation into engineering controls as one combined tier.

Does the Hierarchy of Controls Apply to Psychosocial Hazards?

Yes, in some jurisdictions this is now a specific legal requirement, not just an informal extension of the physical framework. Victoria's 2025 Psychological Health Regulations apply the same eliminate-first structure to psychosocial hazards directly.

Who Decides Which Control to Use?

Overall responsibility sits with the employer, who must ensure the hierarchy is genuinely worked through rather than skipped. In practice, this decision is often delegated to a safety officer or manager, though the underlying legal responsibility stays with the employer.

How Often Should Controls Be Reviewed?

Controls should be reviewed whenever the hazard, process, or equipment involved changes, and periodically even without an obvious trigger, since a control that worked when implemented can quietly become inadequate over time. An incident or near miss involving an existing control should always trigger an immediate review.