What is the Hierarchy of Controls?

Understanding the Legal Framework

The Hierarchy of Controls isn't just a safety guideline—it's a legal requirement under Australian WHS law. The Work Health and Safety Act 2011 and equivalent state legislation mandate that Persons Conducting a Business or Undertaking (PCBUs) must eliminate risks "so far as is reasonably practicable," and where elimination isn't possible, minimise risks using controls in a specific order.

Regulation 36 of the Model WHS Regulations explicitly codifies this hierarchy, creating what safety professionals call a "lock-step" mechanism. You cannot legally justify using PPE or administrative controls unless you can demonstrate that higher-order controls—elimination, substitution, and engineering—were genuinely evaluated and found not reasonably practicable.

This legislative framework exists because accident investigations consistently reveal a pattern: organisations naturally gravitate toward cheaper, easier solutions like procedures and PPE. The law counteracts this tendency by requiring documented consideration of more effective controls first.

The Five Levels: Hard Barriers vs Soft Barriers

The hierarchy distinguishes between "hard barriers" that act on the physical world and "soft barriers" that depend on human behaviour. This distinction is critical because human error is inevitable, making any control that relies on perfect worker compliance inherently unreliable.

The effectiveness percentages reflect real-world reliability. A guardrail (engineering) protects a tired, distracted, or untrained worker just as effectively as an alert one. A safety procedure (administrative) only works if the worker remembers it, has time to follow it, and chooses to comply—every single time.

Level 1: Elimination—The Gold Standard

Elimination is the only control that achieves 100% risk reduction because if the hazard doesn't exist, it cannot cause harm. This is most effectively achieved during the design phase, before equipment is purchased or workplaces are built.

Section 22 of the WHS Act specifically addresses "Safety in Design," imposing duties on designers to eliminate hazards before they reach end users. A designer who specifies heavy materials requiring manual lifting creates a hazard that could have been eliminated by choosing lightweight alternatives.

Practical elimination often looks like process redesign rather than a traditional "safety measure." A construction site switching from manual cement bag handling to bulk silos and pumps eliminates the lifting hazard entirely. Designing window-cleaning mechanisms operable from ground level eliminates the fall hazard. A cleaning company abandoning toxic solvents for high-pressure steam eliminates the chemical exposure.

The primary barrier to elimination is often a failure of imagination. Organisations accept hazards as "part of the job" without questioning whether the job could be done differently. For instance, cordless vacuums eliminate trip hazards from power cords—a simple substitution that removes a specific hazard entirely.

Level 2: Substitution—Trading Down the Risk

When elimination proves impossible, substitution involves replacing a hazardous substance, process, or equipment with something less dangerous. The hazard remains, but its potential for harm is significantly reduced.

Chemical substitution is the most common application: water-based paints replacing solvent-based alternatives reduce flammability and toxicity. The recent silicosis epidemic in Australia has driven regulatory focus toward substituting engineered stone containing crystalline silica with safer composite materials.

Energy substitution also plays a critical role. Battery-operated tools in damp environments reduce electric shock severity from potentially fatal to negligible. The voltage remains, but the energy source changes the risk profile fundamentally.

The critical consideration in substitution is avoiding "regrettable substitution"—replacing one hazard with another that's equally or differently dangerous. Replacing a toxic but non-flammable cleaning agent with a non-toxic but highly flammable one might simply trade a chronic health risk for an acute fire risk. WHS Regulations require risk assessment of the substitute to ensure no new, unmanaged hazards emerge.

Level 3: Engineering and Isolation—Physical Solutions

Engineering controls and isolation both create physical separation between workers and hazards, though they operate differently. Isolation contains or distances the hazard; engineering controls typically modify equipment or environment to reduce exposure.

Isolation strategies include concrete barriers separating pedestrians from forklift traffic, time-based isolation like conducting radiography when buildings are empty, or storing flammable materials in remote blast-proof bunkers. During the COVID-19 pandemic, physical distancing and remote work became primary isolation controls for biological hazards.

Engineering controls integrate protection into the work environment itself. Machine guards prevent contact with nip points. Local exhaust ventilation systems capture welding fumes at source. Safety interlocks cut power when protective barriers are breached. Vacuum lifters reduce manual handling strain by mechanising the lifting process.

For engineering controls to remain effective, they must be difficult to bypass and properly maintained. A guard easily removed to clear jams will inevitably be defeated. A broken sensor or clogged ventilation filter renders the control useless, potentially reverting safety to zero until repaired.

Level 4: Administrative Controls—The Procedure Trap

Administrative controls attempt to manage hazards through systems of work, procedures, training, signage, and scheduling. They rank low in the hierarchy because they rely entirely on human compliance and provide no physical barrier between worker and hazard.

Common examples include job rotation to limit vibration exposure, hot work permits, exclusion zones marked by painted lines, safe work method statements, and training programmes. While valuable as supporting measures, they fail when workers are tired, rushed, distracted, or simply forget a step.

Accident investigations frequently cite "failure to follow procedures" as a cause, but systemic safety analysis views this as a failure of the control itself. If a safety system demands that workers never make mistakes, it's a flawed system. The WHS Act acknowledges this inherent fragility by positioning administrative controls near the bottom of the hierarchy.

Mobile plant incidents exemplify administrative control failure. Exclusion zones marked only by paint or witches' hats offer no protection if a driver is sun-blinded or a worker distracted. Fatality investigations typically recommend upgrading to engineering controls like proximity sensors, cameras, or physical barriers—solutions that don't depend on perfect attention.

Training deserves special mention. While essential for competence, training is merely administrative support within the hierarchy. A highly trained worker can still fall from a ladder; a worker on a properly designed scaffold cannot fall regardless of training level.

Level 5: PPE—The Last Resort

Personal protective equipment sits at the bottom of the hierarchy because it protects only the individual wearer, only when worn correctly, and provides no protection if it fails. PPE does nothing to the hazard itself.

If a glove tears during chemical handling, the worker faces immediate full exposure. If a respirator doesn't fit properly, contaminated air bypasses the filter. PPE can be uncomfortable, leading workers to remove it. Heavy PPE in hot environments can cause heat stress, introducing new hazards while managing others.

Regulation 44 of the Model WHS Regulations specifies that when PPE is necessary, it must be suitable for the task, properly fitted (including fit-testing for respirators), maintained, and replaced when damaged. Workers require training in correct use. This administrative burden often makes comprehensive PPE programmes more expensive over time than engineering solutions with higher upfront costs.

PPE works best as redundancy—a backup to higher-order controls. A chemical plant using closed systems (isolation) and ventilation (engineering) might still issue emergency respirators in case of leaks. Here, PPE serves as secondary defence, not primary protection.

The "Reasonably Practicable" Test

The concept of "reasonably practicable" determines when a PCBU can legally step down from a higher control to a lower one. Section 18 of the WHS Act defines this as an objective test—not what this specific employer thought reasonable, but what a reasonable person in their position would do.

Five factors inform this determination: likelihood of harm, degree of potential harm, state of industry knowledge, availability and suitability of controls, and cost. Critically, these factors aren't weighted equally. Cost is explicitly the least important and can only override safety considerations if "grossly disproportionate" to the risk.

If an engineering control costs $5,000 and the risk involves potential amputation, refusing implementation based on cost would almost certainly fail the reasonably practicable test. Conversely, spending $10 million to eliminate a risk causing minor bruises once per decade might be considered grossly disproportionate.

The "state of knowledge" factor is particularly important. If competitors have successfully eliminated a risk using available technology, that technology becomes part of industry knowledge, effectively making it reasonably practicable across the sector. Ignorance is not a defence; PCBUs must actively seek out knowledge about hazards and controls.

When incidents occur, Regulation 38 requires review of control measures. The incident itself resets the cost-benefit analysis—the risk is now proven, often justifying higher expenditure on superior controls than seemed "practicable" before the event.

Applying the Hierarchy to Psychosocial Hazards

The 2022 Model Code of Practice for managing psychosocial hazards represents a significant evolution in Australian WHS law, explicitly confirming that mental health risks must be managed using the same hierarchy applied to physical hazards.

Many organisations default immediately to "resilience training" (administrative) or Employee Assistance Programs (not even a control, but a restorative measure). However, the WHS Regulations demand elimination and engineering approaches first.

In psychosocial safety, "Good Work Design" functions as engineering control. Increasing worker autonomy over how they perform tasks addresses low job control—a recognised hazard. Clearly defining organisational roles eliminates ambiguity-related stress. These are structural changes to how work is organised, far more effective than teaching workers to "manage stress better."

Recent codes of practice emphasise that relying solely on policies or wellness programmes to manage mathematically impossible workloads likely breaches the WHS Act. If workload is unachievable, the control must be elimination (reduce the load) or engineering (automate tasks), not administrative (time management training).

Documenting Your Hierarchy Decisions

To demonstrate compliance with WHS legislation, organisations must document how they applied the hierarchy. This documentation serves multiple purposes: proving due diligence, supporting continuous improvement, and evidencing "reasonably practicable" determinations during regulatory inspections.

Risk registers should show the progression through hierarchy levels. For each hazard, document: Can we eliminate this? (If no, why not?) Can we substitute? (If no, why not?) What engineering controls are available? Only after establishing that higher controls are not reasonably practicable should administrative controls and PPE appear.

Safe Work Method Statements should list controls in hierarchy order, making the logic transparent. If the SWMS for working at heights shows PPE (harness) without first addressing whether the work could be done from ground level (elimination) or using elevated platforms (substitution), it suggests inadequate hazard analysis.

Section 47 of the WHS Act requires consultation with workers when selecting controls. This isn't merely procedural—workers often know why an engineering control might fail in practice. "That guard makes it impossible to clean the machine, so we remove it" is critical intelligence. Involving workers ensures selected controls are suitable and won't be routinely bypassed, making them functionally useless.

The hierarchy is dynamic, not static. As technology advances, what wasn't reasonably practicable last year may become feasible today. Risk registers require regular review. A "set and forget" approach violates both the continuous improvement mandate of ISO 45001 and the evolving "state of knowledge" criterion in reasonably practicable assessments.

Common Implementation Failures

The "inverted pyramid" problem occurs when organisations spend 80% of effort on PPE and training (bottom of hierarchy) and only 20% on engineering and elimination (top). This effort inversion is a primary driver of workplace incidents.

Many businesses treat the hierarchy as a "menu" of options rather than a mandatory sequence. Jumping directly to PPE because it's cheaper and easier violates legislative requirements. Unless you can document genuine consideration of higher controls and demonstrate why they weren't reasonably practicable, you haven't met your duty of care.

Another common failure is dismissing elimination too quickly with "we've always done it this way" or "that's impossible." Genuine elimination analysis requires questioning fundamental assumptions about work necessity. Does this task need doing at all? Could the process be redesigned entirely?

Control erosion represents a systemic failure mode. Engineering controls degrade over time—sensors break, guards are removed for maintenance and not replaced, ventilation filters clog. If maintenance isn't rigorous, safety gradually reverts to reliance on administrative controls. When those inevitably fail, incidents occur.

The silicosis epidemic among stonemasons illustrates hierarchical failure at scale. Industries relied for years on administrative controls (wet cutting procedures) and PPE (respirators). These failed because wet cutting depends on consistent application and respirators require perfect fit and clean-shaven faces. Regulatory response has forced the hierarchy upward: engineered stone bans (elimination) and mandatory on-tool extraction systems (engineering).

Practical Application Framework

When conducting risk assessment using a risk matrix, work systematically through the hierarchy, documenting each decision. Start by identifying the hazard—for example, forklift traffic in a loading bay.

Ask: Can we eliminate this? Could the warehouse be fully automated with conveyors? If the capital cost is $10 million against annual turnover of $2 million, this likely fails the "grossly disproportionate" test. Document this reasoning.

Ask: Can we substitute, isolate, or engineer controls? Physical barriers separating pedestrians from forklifts, combined with proximity sensors and interlocks, might cost $50,000. Technology is readily available. This is reasonably practicable—you must implement it.

Assess residual risk. Barriers have gaps for loading. The hazard isn't eliminated. Now you add administrative controls (speed limits, traffic management plans, pedestrian awareness training) and PPE (high-visibility vests) to address remaining risk. These support the physical barriers; they don't replace them.

This layered approach provides "defence in depth." If one control fails—say a forklift driver ignores the speed limit—the physical barrier still prevents pedestrian contact. Multiple controls from different hierarchy levels create redundancy, so failure of any single control doesn't immediately result in injury.