The hierarchy of controls is a five-step system for reducing workplace hazards, ranked from most effective to least effective: elimination, substitution, engineering controls, administrative controls, and personal protective equipment (PPE). Developed by the National Institute for Occupational Safety and Health (NIOSH), the framework guides employers to start at the top of the list and work downward, prioritizing solutions that remove or reduce the hazard itself before relying on worker behavior or protective gear.
The logic is simple. Controls at the top physically remove the danger, so they don’t depend on anyone doing the right thing in the moment. Controls at the bottom leave the hazard in place and ask individual workers to protect themselves, which means a single mistake, a poorly fitting mask, or a skipped step can lead to injury. Most real workplaces use a combination of levels, but the goal is always to push as high up the hierarchy as possible.
1. Elimination
Elimination is the most effective control because it makes the hazard disappear entirely. If a danger no longer exists, no one can be harmed by it. NIOSH defines it as removing the hazard at the source, which could mean changing the work process to stop using a toxic chemical, a heavy object, or a sharp tool.
Practical examples span every industry:
- Working at ground level instead of at heights. If a task can be redesigned so workers never need to climb a ladder or scaffold, the fall hazard is gone.
- Automating material delivery. Replacing manual forklift runs with conveyors or automatic guided vehicles removes the risk of pedestrian-forklift collisions entirely.
- Redesigning warehouse intersections. Changing the layout and storage placement to eliminate blind spots prevents collisions without relying on mirrors or warning signs.
- Restricting foot traffic. Allowing only essential personnel in a warehouse while fork trucks are operating eliminates exposure for everyone else.
Elimination is often the hardest control to implement because it may require redesigning a process from scratch. But when it’s feasible, it’s the only control that reduces risk to zero for that specific hazard.
2. Substitution
Substitution keeps the same general process but swaps in something less dangerous. The hazard still exists in a sense, but its severity drops significantly.
OSHA describes substitution as changing out a material or process to reduce the hazard. That could mean switching to a less hazardous material, or switching to a process that uses less force, speed, temperature, or electrical current. A printing shop, for instance, might replace solvent-based inks with plant-based inks, cutting workers’ exposure to harmful fumes without changing the printing workflow itself. A warehouse might replace traditional forklifts with powered walk-beside pallet jacks or hand trucks, which move slower and give operators better visibility.
Substitution and elimination are often grouped together as the most desirable controls because they tackle the hazard before it ever reaches a worker. They’re also easiest to implement during the design phase of a new process. Retrofitting an existing operation is more expensive and disruptive, which is why safety professionals push to consider these top-tier controls early.
3. Engineering Controls
Engineering controls don’t remove the hazard, but they physically isolate workers from it. These are built into the equipment or environment so they work automatically, without requiring workers to remember a procedure or wear something.
Common examples include:
- Local exhaust ventilation. A vent hood positioned directly over a chemical process captures fumes before they reach the breathing zone. Fume hoods in laboratories and paint booths in auto shops work on the same principle.
- Machine guards and shields. Physical barriers around moving parts, blades, or pinch points prevent hands and clothing from reaching the danger zone.
- Sound enclosures. Wrapping noisy machinery in insulated housing lowers the decibel level for everyone nearby, reducing hearing damage without requiring earplugs.
- General ventilation systems. Dilution ventilation circulates fresh air throughout a workspace, lowering the overall concentration of airborne contaminants.
Engineering controls rank in the middle of the hierarchy because they’re highly reliable once installed, but they don’t remove the hazard. A machine guard works every time it’s in place, but if someone removes it for maintenance and forgets to replace it, the danger returns. They also require upfront investment and ongoing maintenance to stay effective.
4. Administrative Controls
Administrative controls change the way people work rather than changing the physical environment. They include policies, procedures, training programs, schedules, and signage designed to reduce exposure.
Examples you’d see in a typical workplace:
- Job rotation. Rotating workers through tasks limits how long any single person is exposed to a hazard like repetitive motion, loud noise, or chemical fumes.
- Standard operating procedures. Written step-by-step instructions for high-risk tasks (like lockout/tagout for equipment maintenance) reduce the chance of mistakes.
- Safety training. Teaching workers to recognize hazards and respond correctly, from chemical spill response to proper lifting technique.
- Warning signs and labels. Posted alerts about wet floors, high-voltage areas, or chemical storage zones.
- Scheduling high-risk work during off-hours. Performing noisy demolition or chemical cleaning when fewer people are in the building limits the number of workers exposed.
Administrative controls are less effective than the three levels above them because they depend entirely on human behavior. Training only works if people remember and follow it. Schedules only work if managers enforce them. A posted sign does nothing for the worker who’s rushing and doesn’t look up. These controls are important as a supporting layer, but they should never be the primary defense against a serious hazard when a higher-level control is possible.
5. Personal Protective Equipment (PPE)
PPE is the last line of defense: gloves, safety glasses, hard hats, respirators, hearing protection, high-visibility vests, steel-toed boots, and fall harnesses. It sits at the bottom of the hierarchy because it does nothing to reduce the hazard itself. The danger is fully present, and the equipment simply places a barrier between it and the worker’s body.
PPE fails more often than any other control for several reasons. It has to fit correctly to work. A respirator with gaps around the seal lets contaminated air through. Gloves that are too thick for the task get removed. Hearing protection left in a locker protects no one. PPE also puts the entire burden on the individual worker, every shift, every time. One moment of forgetfulness or discomfort, and the protection disappears.
That said, PPE is sometimes the only practical option, especially for short-duration tasks, emergency situations, or hazards that can’t be fully controlled by other means. Construction workers wear hard hats not because better controls don’t exist, but because falling objects are an unpredictable hazard on an active job site. Healthcare workers wear gloves and masks because complete elimination of infectious exposure isn’t realistic in patient care. In these cases, PPE serves as a necessary backup while higher-level controls handle what they can.
Using Multiple Controls Together
In practice, most workplaces layer several levels of the hierarchy on top of each other. A factory with a noisy machine might enclose it in a sound-dampening housing (engineering control), limit the time any worker spends near it (administrative control), and still require hearing protection for anyone who enters the area (PPE). Each layer catches what the one above it misses.
The key principle is priority, not exclusivity. You don’t pick one level and stop. You start at the top, implement the highest-level control that’s feasible, and then add lower-level controls to cover remaining risk. A workplace that jumps straight to PPE without considering whether the hazard could be eliminated, substituted, or engineered away is, by NIOSH’s framework, doing it in the wrong order.
When evaluating your own workplace or studying for a safety certification, the hierarchy gives you a structured way to think through every hazard: Can we get rid of it? Can we swap it for something safer? Can we put a physical barrier between it and people? Can we change procedures to limit exposure? And finally, what protective equipment covers the gap?