Hierarchy of risk controls

What is the hierarchy of controls?

The hierarchy of controls orders preventive measures from most to least effective. In its most widely used formulation, that of the U.S. National Institute for Safety and Health at Work (NIOSH), it consists of five levels: elimination, substitution, engineering controls, administrative controls, and personal protective equipment (PPE). The first three act on the hazard or exposure without requiring any action from the individual; the last two depend on the procedure being followed and the equipment being used correctly, and are therefore less reliable and should be reserved for risks that persist after the previous measures have been applied.

In Spain, the hierarchy doesn’t appear under that name, but it is incorporated into Article 15 of Law 31/1995 as principles of preventive action: avoid risks, assess those that cannot be avoided, combat them at their source, adapt the work to the individual, take into account technological developments, replace hazardous elements with those that pose little or no danger, plan prevention, and prioritize collective protection over individual protection. Framework Directive 89/391/EEC contains the same sequence in its Article 6.2.

The hierarchy is a decision criterion, not a checklist. It requires justification for why a hazard hasn’t been eliminated or replaced before accepting lower-level measures, and that’s why it’s useful in the face of inspections, audits, and worker representatives: it makes the choice of measures a traceable process.

Differences between hierarchy of controls, preventive measures and collective protection

These three concepts overlap, but each one answers a different question.

• Hierarchy of controls. Ordering criterion: states which type of measure should be considered before another. It does not describe specific measures.
• Preventive and control measures. Specific actions taken to eliminate or reduce a risk, whatever its level in the hierarchy: from redesigning a process to providing PPE.
• Collective protection. Category of technical measures that protect several people simultaneously (guardrails, nets, local exhaust ventilation). It falls under the level of engineering controls and, by law, must take precedence over individual protection.

Practical rule: hierarchy is applied when deciding; measures are the result of the decision; collective protection is a family of measures located at the top of the hierarchy.

How hierarchy is applied in practice

Applying the hierarchy involves working through the levels from top to bottom for each unacceptable risk, documenting at each step why the next level is being considered. The risk assessment provides the initial data, and the planning of preventive activities incorporates the results.

The usual sequence is as follows:

1. Elimination: Check if the task, equipment or substance can be eliminated or redesigned so that the hazard disappears (e.g., prefabricate in a workshop to avoid working at height).
2. Substitution: replacing the agent or process with a less hazardous one (a substance with lower toxicity, equipment with a lower noise level).
3. Engineering controls: isolating or separating the hazard from people through guards, interlocks, local exhaust ventilation, acoustic enclosures or collective protection.
4. Administrative controls: procedures, work permits, signage, rotation, exposure time limitations, training and information.
5. Personal protective equipment: selected for the residual risk, with defined criteria for suitability, use and maintenance.
6. Verification: check that the measure has been implemented, that it works and that the risk level decreases; if not, return to the higher levels.

In most cases, the solution combines several levels. An acoustic enclosure (engineering) may require an access procedure (administrative) and hearing protection for maintenance work (PPE). What the hierarchy prohibits is starting with the PPE or the procedure when it is technically and reasonably possible to act first.

Hierarchy levels and examples

Each level groups together measures of a different nature. A general classification:

• Elimination. Eliminate the hazardous operation, automate a manual task with a risk of entrapment, design facilities that do not require access to areas with energy.
• Substitution. Replacing a solvent classified as carcinogenic with one that is not classified as such, replacing a vibrating tool with a low-vibration tool, replacing ladders with platforms.
• Engineering controls. Fixed and movable guards with interlocking, local exhaust ventilation systems, railings and nets, general ventilation, sound insulation, emergency stop devices.
• Administrative controls. Safe work procedures, work permits, energy storage, signage, job rotation, breaks, health surveillance, training and instructions.
• Personal protective equipment. Helmet, hearing protection, respiratory protection, fall arrest harness, gloves and safety footwear, always as a complement and not as a substitute for the previous levels.

The classification is not rigid. Some measures fall between two levels, and the relevant factor is the criterion: the less protection depends on each person’s behavior, the higher their position in the hierarchy.

Common mistakes when applying the hierarchy

In preventive practice, some errors are repeated that empty the hierarchy of its meaning:

1. Jumping directly to PPE or the procedure because they are the quickest and cheapest measures to implement, without documenting why it is not eliminated or controlled at the source.
2. Consider training as sufficient control against hazards that require technical measures.
3. Assessing residual risk as acceptable simply by delivering PPE, without verifying suitability and actual use.
4. Applying the hierarchy only to safety and forgetting it in hygienic, ergonomic or psychosocial risks, where there are also elimination and design measures.
5. Not reviewing the decision when the evolution of technology offers solutions that were not previously viable.
6. Confusing hierarchy with cost: a higher-level measure is not always more expensive in the medium term, and the law requires it to be considered in any case.

The traceability reference is the planning document: for each risk, what levels have been considered, which one has been adopted and why.

Regulatory framework in Spain and the European Union

• Law 31/1995, article 15. Principles of preventive action: avoid risks, assess unavoidable risks, combat them at their source, replace what is dangerous, plan prevention and adopt measures that prioritize collective protection over individual protection; this is the Spanish formulation of the hierarchy.
• Directive 89/391/EEC, Article 6. General principles of prevention that Member States have transposed, with the same sequence of avoiding, assessing, combating at source, replacing and prioritizing collective protection.
• Royal Decree 39/1997, articles 8 and 9. They require that the measures derived from the evaluation be planned with priorities, deadlines and responsible parties; hierarchy is the criterion with which these priorities are ordered.
• Royal Decree 773/1997, Article 4. Personal protective equipment must be used when risks cannot be avoided or sufficiently limited by technical means of collective protection or by work organization measures.

In the United States, NIOSH and OSHA promote the five-level hierarchy as a recommended practice; it is a useful technical reference for naming the levels, but not a regulation applicable in Spain. ISO 45001 incorporates an equivalent hierarchy in its hazard elimination and risk reduction requirements.