A control measure is any action, device, process, or strategy used to eliminate or reduce a hazard. The term comes up most often in workplace safety, where control measures are ranked from most to least effective in a framework called the hierarchy of controls. But the concept applies broadly: any step you take to lower risk, whether in a factory, a lab, or an office, counts as a control measure.
The key idea is that not all control measures work equally well. Removing a hazard entirely is always more reliable than asking people to protect themselves from it. That distinction shapes how safety professionals choose and layer their controls.
The Hierarchy of Controls
OSHA and the CDC’s National Institute for Occupational Safety and Health (NIOSH) organize control measures into five levels, ranked from most to least effective. The top three levels (elimination, substitution, and engineering controls) are considered more effective because they work without relying on human behavior. Administrative controls and personal protective equipment, by contrast, depend on people consistently doing the right thing.
Here’s how the five levels break down:
- Elimination: Remove the hazard completely. Stop using a dangerous chemical, do the work at ground level instead of at height, or end a noisy process altogether.
- Substitution: Swap the hazard for something less dangerous. Use plant-based printing inks instead of solvent-based ones, or switch to a process that requires less force, speed, or temperature.
- Engineering controls: Put a physical barrier or system between the worker and the hazard. Ventilation systems, machine guards, noise enclosures, guardrails, and lift equipment all fall here.
- Administrative controls: Change how work is done through procedures, training, or warnings. This includes job rotation, safety checklists, equipment inspections, warning signs, backup alarms, and scheduled rest breaks.
- Personal protective equipment (PPE): Gear worn by the worker, such as safety glasses, hard hats, respirators, hearing protection, and harnesses.
Why the Order Matters
The ranking exists because each level shifts responsibility differently. If you eliminate a hazard, nobody has to remember anything or wear anything. A guardrail protects every worker who walks past it, whether they’ve had safety training or not. But a hard hat only works if someone actually puts it on, wears it correctly, and replaces it when it’s damaged.
PPE in particular requires constant effort and attention from workers. Respirators, for example, only perform as expected when they’re properly fitted, maintained, and used as part of a full respiratory protection program that includes training and fit testing. Even a small gap in the seal of a face mask dramatically reduces its protection. That’s why safety standards treat PPE as a last line of defense, not a first choice. It’s used when higher-level controls aren’t feasible or while they’re being put in place.
Engineering controls, on the other hand, tend to be “set and forget” solutions. A ventilation system that pulls contaminated air away from a worker’s breathing zone operates continuously without anyone needing to think about it. Even a modest noise-reduction measure matters: a 3-decibel decrease in noise exposure measurably lowers a worker’s risk of hearing loss over time.
Layering Multiple Controls
In practice, most workplaces use several control measures together. Administrative controls, for instance, are rarely used alone. OSHA notes they’re often paired with higher-level controls to fill gaps. A factory might install machine guards (engineering control) and also train workers on lockout procedures (administrative control) and require safety glasses (PPE) as a backup.
This layering matters because individual controls can introduce new hazards of their own. Automating material delivery with conveyors, for example, eliminates the risk of forklift collisions. But workers might then need to walk through other hazardous areas to check inventory. Substituting powered walk-beside forklifts for traditional fork trucks reduces collision risk but may increase physical strain on the operator. Every control measure needs to be evaluated not just for what it prevents but for what new risks it might create.
Control Measures Beyond the Workplace
The term “control measure” also appears in scientific research, though it means something slightly different. In an experiment, controls are comparison groups that help researchers verify their results are real. A negative control receives no treatment at all, so any unexpected result signals contamination or error. A positive control receives a treatment already known to work, confirming that the experimental setup can detect the effect being studied. Both are measures that control for variables that could otherwise muddy the results.
In risk management more broadly, control measures are evaluated using a simple formula: residual risk equals inherent risk minus the impact of your controls. If a workplace hazard carries a high inherent risk and your control measure only reduces it slightly, the residual risk is still too high, and you need stronger or additional measures.
Evaluating Whether Controls Actually Work
Putting a control measure in place is only half the job. You also need to verify it’s performing as intended. Organizations track this through a few practical indicators: the percentage of safety recommendations that have actually been implemented, the number of repeat findings on safety audits (which suggests a control isn’t solving the problem), and the number of open audit findings that have passed their deadline for correction.
Ongoing monitoring tends to be more useful than one-time checks. Periodic reviews that include worker surveys, risk reassessments, and analysis of incident data help catch controls that looked good on paper but aren’t holding up in daily operations. A ventilation system that was properly designed but poorly maintained, for example, may slowly lose effectiveness without anyone noticing until an exposure incident occurs.
The most reliable approach is to treat control measures as living systems. Review them on a schedule, measure their outcomes against specific targets, and be prepared to move up the hierarchy if a lower-level control isn’t reducing risk enough. A workplace that relies heavily on PPE and training when an engineering solution is feasible is accepting more risk than it needs to.