Hierarchy of Controls: The Levels, With Examples From Buildings & Depots

Ask a site team how a hazard is controlled and the answer is usually a sign, a toolbox talk, or a pair of gloves. Those are real controls, but they are the bottom of the list, and the hierarchy of controls exists to make you try everything above them first. This guide is for the safety manager and the facilities manager who need to choose a control for a contractor's job and be able to say why it was the right one.

The examples come from office buildings, hospitals, and campuses in property and facilities management, and from distribution centres in transport and logistics. They are illustrations, not customers.

What Is the Hierarchy of Controls?

It is a ranking. Safe Work Australia's code of practice on managing risks puts the ways of controlling a risk in order from the highest level of protection and reliability to the lowest, and calls that ranking the hierarchy of control measures.¹ It can be applied to any risk, and the model WHS Regulations make it mandatory for certain risks.¹

The logic is simple. A control that removes the hazard protects everyone, every time, without anyone having to remember anything. A control that relies on a person doing the right thing protects only the people who do it, on the days they do it. The code says it directly: you cannot eliminate a risk without eliminating the hazard, and the lower levels can only minimise it.¹

What Are the Levels of the Hierarchy of Controls?

From the top, they are elimination; substitution, isolation, and engineering controls; administrative controls; and personal protective equipment. Diagrams vary in how many boxes they show, but the code and the model Regulations treat the middle three as one step, any of which can be used alone or together.¹²

Elimination.

Remove the hazard, or never bring it in. The code's examples are doing work at ground level instead of at height, not using a noisy machine rather than handing out hearing protectors, and removing trip hazards or unwanted chemicals.¹ In a building, that might mean relocating a rooftop exhaust fan's controls to a plant room at ground level so the HVAC technician never goes onto the roof to reset it.

Substitution.

Swap the hazard for something less hazardous. The code's example is water-based paint in place of solvent-based paint, and WorkSafe Victoria adds a scourer, mild detergent, and hot water in place of caustic cleaners.¹⁵ For a hospital's cleaning contractor, that is a product decision made once at procurement that protects every cleaner on every shift.

Isolation.

Separate people from the hazard by distance or a barrier: guardrails around holes and edges, remote controls for machinery, chemicals stored in a fume cabinet.¹ WorkSafe Victoria's example is concrete barriers that separate pedestrians from powered mobile plant, which is the forklift problem in every warehouse.⁵

Engineering Controls.

A physical change: a mechanical device or process. The code lists trolleys and hoists for heavy loads, guards around moving parts, and residual current devices, the electrical safety switches.¹ A lift in place of a stair carry for chiller parts, or an interlocked guard on a conveyor, belongs here.

Administrative Controls.

Procedures, training, instruction, limits on exposure time, and signs.¹ Some are needed to make the higher controls work, such as following safe work procedures when using equipment.¹ A guard is only effective if the procedure says to put it back. Permits to work, inductions, and safe work method statements live at this level too.

Personal Protective Equipment.

Ear muffs, respirators, hard hats, gloves, and eye protection. The code's warning is in one sentence: PPE limits exposure only if workers wear and use it correctly.¹ Under the model Regulations it must also be selected to suit the work and the hazard and be of suitable size and fit, and workers must use it in line with the training and instruction they are given, so far as they are reasonably able.¹²

Is the Hierarchy of Controls a Legal Requirement in Australia?

Yes, in every state and territory except Victoria, for most of the risks the WHS Regulations require a duty holder to manage; Victoria is below. Section 17 of the model WHS Act requires a duty holder to eliminate risks to health and safety so far as is reasonably practicable, and, if that is not reasonably practicable, to minimise them so far as is reasonably practicable.³ Regulation 36 then sets the order for minimising: substitution, isolation, or engineering controls first; administrative controls for any risk that remains; and suitable PPE for anything left after that, each so far as is reasonably practicable. A combination may be used where one control is not enough.² Psychosocial risks are the exception: regulation 55C takes them out of that order, and regulation 55D sets their own duty to eliminate or minimise them so far as is reasonably practicable.²

"Reasonably practicable" is weighed. Section 18 lists what goes into it: how likely the risk is, how bad the harm could be, what the duty holder knows or ought to know, what ways exist to remove or reduce it, how available and suitable they are, and only then the cost, and whether it is grossly disproportionate to the risk.³

Some risks carry their own order on top. For a fall from one level to another that is reasonably likely to cause injury, the model Regulations require the work to be done on the ground or on a solid construction so far as is reasonably practicable; otherwise a fall prevention device, then a work positioning system, then a fall arrest system.² That is the hierarchy written out for one hazard.

The model laws have been implemented in every state and territory except Victoria, and some have made variations.⁴ In Victoria, WorkSafe Victoria describes the employer's duty under the Occupational Health and Safety Act 2004 as eliminating risks so far as is reasonably practicable and, where that is not reasonably practicable, reducing them so far as is reasonably practicable, and it uses the same hierarchy to explain how.⁵ Victoria's Occupational Health and Safety Regulations 2017 also write the order into law for particular hazards; for falls, regulation 44 runs from eliminating the risk to a passive fall prevention device, then a work positioning system, then a fall arrest system.⁶

Why Signs & Toolbox Talks Sit Near the Bottom.

The code says administrative controls and PPE are the least effective because they do not control the hazard at its source and rely on human behaviour and supervision. It says they should only be used as a back-up to higher controls, as a short-term measure until something better is in place, or as a last resort.¹

Cost is the usual reason a site stops at a sign. The code shuts that door: cost can be taken into account in working out what is reasonably practicable, but it cannot be a reason for doing nothing, and it cannot justify controls that rely only on changing people's behaviour when substitution, engineering, or isolation controls are available.¹

Training has a bar of its own. The code says it is not enough to hand a worker a procedure and ask them to acknowledge they understand it; training should require them to show they can do the task.¹ A signed induction is a record that something was read. It is not proof the control works.

How to Choose Between Two Controls on the Same Level.

Pick the one that gives the highest level of protection and depends least on people remembering, that you can actually get, and that suits the site.¹ Where two options give the same protection and are equally reliable, the code says you can take the cheaper one; and the greater the likelihood or extent of harm, the less weight cost should carry.¹

One more point in the code changes the choice for serious hazards. Where a hazard could cause death, serious injury, or illness, the code says to give more emphasis to controls that reduce the level of harm than to those that only make it less likely, and to check the new control does not create a new hazard.¹ At a distribution centre, a speed limiter on a reach truck and a proximity warning are both engineering controls; the limiter makes a strike less severe while the warning only makes it less likely, so where a strike could kill, the limiter goes in first.

A Worked Example: Rooftop Plant on an Office Tower.

A mechanical contractor services six condensing units on the roof of a 20-storey office building every quarter. The roof has a parapet 400 millimetres high, a fragile skylight, and an access hatch from the plant room. The facilities manager works down the hierarchy with the contractor before the next visit, which is also how the consultation duties in the model WHS Act are met: workers who are likely to be directly affected must be consulted, so far as is reasonably practicable, when decisions are made about ways to eliminate or minimise risks, and businesses sharing a duty must consult, co-operate, and co-ordinate with each other.³

• Eliminate. Two units can be monitored remotely, so routine checks on those stop needing a roof visit at all. The others still do.
• Isolate. A permanent guardrail along the parapet and a mesh cage over the skylight, so nobody can reach either edge.
• Engineer. A davit at the hatch to lift parts, so no technician climbs the ladder carrying a compressor.
• Administrative. Roof access by permit only, with the hatch key held at the building management office and the visit logged.
• PPE. Gloves and eye protection for the work itself. No harness is needed at the edge, because the guardrail removed the fall.

The order matters most at the edge. The first draft from the contractor proposed harnesses and a spotter. Under the falls regulation, a fall prevention device such as edge protection comes before a work positioning system or a fall arrest system such as a harness, so the guardrail went first and the harness came off the list.²

A Worked Example: Forklifts & Pickers at a Distribution Centre.

A distribution centre runs reach trucks in the same aisles as order pickers on foot, and a contract cleaning crew works the night shift. The warehouse manager's register lists "forklift and pedestrian interaction" with a single control: high-visibility vests.

Worked down the hierarchy, the list changes. Elimination is not reasonably practicable while picking and replenishment share aisles. Isolation comes first: fixed barriers between the main forklift route and the pedestrian walkway, as in WorkSafe Victoria's example.⁵ Engineering controls on the trucks follow, such as speed limiting and blue warning lights. Then the administrative layer, led by a strong one: moving the replenishment window to a time when no pickers are in those aisles, which removes the interaction for most of the shift. After that come aisle closure rules when a truck is in an aisle, and a briefing for the cleaning crew on which zones are live at night. The vests stay, at the bottom, where they belong.

The night cleaners are why the review could not stop at the day shift. They are a different employer's workers, on site when the day supervisor is not, so the warehouse manager agreed the live zones with the cleaning contractor's supervisor, wrote them into the contractor's site procedure, and recorded each control in the register against its level.

Controls Wear Out: Maintenance & Review.

A guardrail that was installed in 2019 and has not been looked at since is not a control anyone should rely on. Regulation 37 requires a control measure to be maintained so it remains effective, including being fit for purpose, suitable for the work, and installed and used correctly.²

Regulation 38 adds when to look again: when a control does not control the risk it was put in for, before a change at the workplace that is likely to create a new or different risk, when a new hazard or risk is found, when consultation shows a review is needed, and when a health and safety representative asks in the circumstances the regulation sets out.² In a building, a tenant fit-out or a new rooftop installation is that change. At a depot, it is a new racking layout or a new fleet of trucks.

Contractors are where controls most often drift, because the people relying on the control are not the people who installed it. Their safe work method statements should name the higher-level controls the job depends on, not only the procedure and the PPE. Our guide to what a SWMS must contain covers what to look for when one lands on your desk, and our guide to lockout tagout covers the isolation step for plant and electrical work.

Recording the Level Against Every Control.

The quickest test of a register is to ask how many of its controls are signs, procedures, and PPE. Most registers cannot answer, because the level was never written down.

In ComplyFlow's risk register, each control is recorded with its hierarchy of control level, from elimination to PPE, the date it took effect, supporting files, and whether it is mandatory.⁷ Risks carry an initial score from your risk matrix and a residual score set by the risk owner or assessor once the controls are in, and a consolidated view shows each risk across every site where it appears, with the highest residual risk shown.⁸ Our guide to the risk matrix covers how those scores are set.

Sort Your Register by Level, Not by Score.

Take your top 20 risks and write the level next to every control on them. Count how many rely only on administrative controls and PPE. Each of those is a question for the next site meeting: is there a barrier, a guard, a substitute, or a change of method that would take the hazard away from people instead of asking people to stay away from the hazard?

Expect the answer to be yes more often than the register suggests, and expect your contractors to have the best ideas, because they are the ones working beside the hazard. To see controls recorded by level across every site and contractor, book a demo and bring the risk your team has been controlling with a sign.