The hierarchy of control measures is a five-tier ranking that workplaces use to decide how to handle a hazard, ordered from most effective to least: elimination, substitution, engineering controls, administrative controls, and personal protective equipment (PPE).1Occupational Safety and Health Administration (OSHA). Identifying Hazard Control Options: The Hierarchy of Controls The logic behind the order is straightforward. A hazard that no longer exists cannot hurt anyone. A pair of gloves only works if somebody remembers to put them on. Everything about how the hierarchy is used flows from that difference.
The Five Tiers, From Most to Least Effective
Elimination
Elimination removes the hazard entirely. If a manufacturing step requires workers to climb onto an elevated platform, redesigning the process so the work happens at ground level eliminates the fall risk altogether. No amount of training or safety gear can match that level of protection, because there is nothing left to protect against.
Substitution
When full elimination is impractical, substitution replaces the hazard with something less dangerous. Swapping a toxic solvent for a non-toxic alternative that achieves the same industrial result is a textbook example. Substitution sits with elimination at the top of the hierarchy because both address the source of the danger rather than managing exposure to it.
Engineering Controls
Engineering controls physically isolate people from a hazard without relying on anyone to behave correctly. Machine guards, local exhaust ventilation, sound-dampening enclosures, and guardrail systems all fall into this category. Because these protections are built into the workspace itself, they work continuously once installed. The trade-off is cost and maintenance. Ventilation systems need filter changes, machine guards need inspections, and any modification to the process may require a review of whether the existing controls still fit.
Administrative Controls
Administrative controls change how work is performed rather than changing the physical environment. Rotating workers through high-exposure tasks to limit individual dose, posting warning signage, establishing lockout/tagout procedures, and scheduling noisy operations during shifts with fewer workers nearby all qualify. These controls do not remove the hazard. They reduce the chance and duration of exposure through rules, schedules, and training. The weakness is obvious: they depend entirely on consistent human compliance. A rotation schedule only works if supervisors enforce it every shift.
Personal Protective Equipment
PPE sits at the bottom because it is the last line of defense and the most dependent on individual behavior. Safety glasses, hard hats, respirators, hearing protection, and chemical-resistant gloves all create a physical barrier between the worker and whatever residual risk remains after higher-tier controls have been applied. If a respirator doesn’t seal properly against someone’s face, or a worker takes off their gloves for “just a second,” the protection vanishes instantly. OSHA’s hazard assessment regulation treats PPE as something you turn to after evaluating the workplace, not as a default starting point.2eCFR. 29 CFR 1910.132 – General Requirements
Why the Order Is a Legal Requirement, Not Just a Suggestion
OSHA treats the hierarchy as recommended best practice in its general guidance, but several specific standards make higher-tier controls a legal prerequisite. The respiratory protection standard explicitly requires employers to use engineering controls like ventilation before resorting to respirators whenever feasible.3Occupational Safety and Health Administration. 29 CFR 1910.134 – Respiratory Protection Skipping to PPE because it is cheaper or faster is not a defensible choice when a feasible engineering solution exists.
The broader legal foundation is Section 5(a)(1) of the Occupational Safety and Health Act, the General Duty Clause, which requires every employer to provide a workplace “free from recognized hazards that are causing or are likely to cause death or serious physical harm.”4Occupational Safety and Health Administration. OSH Act of 1970 – Section 5 Duties That clause applies even when no specific OSHA standard covers the hazard. An employer cannot ignore a known danger just because no regulation spells out exactly what to do about it.
Choosing the Right Tier: The Hazard Assessment
Selecting the right control measures starts with figuring out what can hurt people and how badly. Under 29 CFR 1910.132, employers must assess the workplace to determine whether hazards are present that require PPE, then select equipment that matches the identified risks and fits each affected worker.2eCFR. 29 CFR 1910.132 – General Requirements The assessment should not stop there. Following the hierarchy means first asking whether the hazard can be eliminated or engineered out before even considering protective gear. If a risk of falling from heights shows up in the assessment, the focus belongs on guardrails before anyone starts shopping for harnesses.
The employer must document the assessment with a written certification that identifies the workplace evaluated, the person who performed the evaluation, and the date of the assessment.2eCFR. 29 CFR 1910.132 – General Requirements Skipping that paperwork is one of the easiest ways to draw a citation during an OSHA inspection.
Bring Workers Into the Decision
The people closest to the hazards usually know the most about them. OSHA recommends actively involving workers in hazard identification and control selection through open discussion sessions, anonymous suggestion systems, and safety committees that represent as many job functions as possible.5Occupational Safety and Health Administration. Be Safe + Sound at Work: Worker Participation Employees who help choose a control are far more likely to follow it.
Interim Protection While Higher-Tier Controls Are Being Built
Installing a ventilation system or redesigning a production line takes time. OSHA’s safety and health program guidelines are explicit that employers must provide interim protection while permanent controls are being developed and implemented.6Occupational Safety and Health Administration. OSHA Safety and Health Program Management Guidelines – Hazard Prevention and Control In practice, this usually means combining administrative controls with PPE as a temporary measure. Telling workers “we ordered the guardrails” is not a substitute for handing out harnesses today. The interim plan should track progress toward the permanent solution so temporary measures don’t quietly become permanent ones.
Keeping Controls Working Once They Are In Place
Installed controls degrade. Ventilation filters clog, machine guards get removed for maintenance and never replaced, signage fades, and workers develop shortcuts. Regular audits should examine the physical condition of engineering controls, verify that PPE is being worn correctly and is still in serviceable condition, and confirm that employees are following established procedures.
Some inspection frequencies are set by regulation. The lockout/tagout standard requires a periodic inspection of energy control procedures at least annually.7Occupational Safety and Health Administration. Lockout/Tagout – Tutorial – Periodic Inspection Where no specific frequency is mandated, the schedule should reflect the severity of the hazard and how quickly the control is likely to deteriorate. A guardrail on a busy loading dock needs more frequent checks than one in a low-traffic storage area. Every inspection should be documented with the date, the inspector’s name, findings, and any corrective actions taken.
Training keeps the human side of the hierarchy functional. OSHA’s Hazard Communication standard requires training on hazardous chemicals at the time of initial assignment.8Occupational Safety and Health Administration. 29 CFR 1910.1200 – Hazard Communication Several high-risk areas demand annual retraining, including work with bloodborne pathogens, lead, asbestos, and portable fire extinguisher use. Process safety management refresher training must happen at least every three years, and hazardous waste operations require eight hours of annual refresher training for involved employees and supervisors.9Occupational Safety and Health Administration (OSHA). Training Requirements in OSHA Standards
What It Costs to Get the Hierarchy Wrong
OSHA adjusts its maximum civil penalty amounts every January. Current maximums are:
- Serious, other-than-serious, and posting violations: up to $16,550 per violation
- Failure to abate: up to $16,550 per day beyond the abatement deadline
- Willful or repeated violations: up to $165,514 per violation
A single inspection that uncovers multiple willful violations can result in penalties well into six figures.10Occupational Safety and Health Administration. OSHA Penalties The failure-to-abate penalty is particularly punishing because it compounds daily. An employer who receives a citation and ignores the abatement deadline can watch the fine climb by more than $16,000 every day the hazard remains. When investigators look at how a serious incident happened, the question they tend to ask is not whether the worker followed the rules, but why the higher-tier controls that should have made those rules unnecessary were absent or inadequate.