Table of Contents
The hierarchy of controls explained, with workplace examples
The six ways to control a WHS risk, ranked from most to least effective
If you manage work health and safety in Australia, the hierarchy of controls is the single most useful idea to understand. It ranks the ways you can control a risk, from the most effective (getting rid of the hazard altogether) to the least effective (relying on personal protective equipment). It is also written into WHS law, so it isn't just good practice: in most of Australia it is how you are legally required to choose your controls.
This guide explains each level of the hierarchy with practical examples, what the law requires, and the mistakes that most often get businesses into trouble.
What is the hierarchy of controls?
The hierarchy of controls is a ranked list of control measures for managing workplace risks. The higher a control sits in the hierarchy, the more reliable it is, because it depends less on people remembering to do the right thing every time.
The model Work Health and Safety Regulations set out the hierarchy in regulation 36. The model laws apply in every state and territory except Victoria, and to Commonwealth workplaces. Safe Work Australia's model Code of Practice, How to manage work health and safety risks, groups the controls into three levels:
- Level 1: elimination. Remove the hazard completely. This is the most effective control.
- Level 2: substitution, isolation and engineering controls. Reduce the risk by changing the thing, separating people from it, or changing the plant or process.
- Level 3: administrative controls and personal protective equipment (PPE). Reduce the risk by changing how people work, or by protecting the individual worker. These are the least effective controls.
You are expected to work down the hierarchy: consider elimination first, and only move to a lower level when the one above isn't reasonably practicable.
The six controls, with workplace examples
1. Elimination
Elimination removes the hazard, and with it the risk. If the hazard isn't there, nobody can be hurt by it.
Examples:
- doing work at ground level instead of at height, such as assembling a roof frame on the ground and lifting it into place
- removing a trip hazard by rerouting cables under the floor
- getting rid of a piece of unused, unguarded machinery instead of putting up a warning sign
- buying in a product already cut to size so that nobody has to cut it on site
Elimination is easiest at the design and planning stage, when you are choosing equipment, designing a workplace or planning a job. Once a hazard is built in, removing it usually costs much more.
2. Substitution
Substitution replaces the hazard with something that carries less risk.
Examples:
- using a water-based paint or cleaning product instead of a solvent-based one
- using a lighter or smaller pack size so items are easier to lift
- swapping a noisy machine for a quieter model
- using a scissor lift or elevating work platform instead of a ladder
A well-known Australian example is engineered stone. After a rise in silicosis among workers who cut it, engineered stone benchtops, panels and slabs were banned across Australia from 1 July 2024, with limited exceptions. Businesses had to substitute lower-silica materials.
Substitution only works if the replacement doesn't bring new hazards with it, so check the safety data sheet or specifications of whatever you switch to.
3. Isolation
Isolation separates people from the hazard by distance or with a physical barrier.
Examples:
- physical barriers that separate pedestrian walkways from forklift routes
- putting a noisy compressor in a separate, enclosed room
- fencing off an excavation or a work zone
- locking chemical stores so only trained staff can enter
4. Engineering controls
Engineering controls change the plant, equipment or process to reduce the risk at its source. They don't rely on people's behaviour.
Examples:
- guards on moving machinery, with interlocks that stop the machine when the guard is opened
- local exhaust ventilation that captures dust or fumes where they are created
- water suppression on saws and grinders to stop dust becoming airborne
- mechanical aids such as hoists, trolleys and vacuum lifters for heavy loads
- guardrails on mezzanine floors and roof edges
5. Administrative controls
Administrative controls change the way people work. They include procedures, training, signs, rosters and supervision.
Examples:
- safe work procedures and job rotation to limit time on repetitive tasks
- permit-to-work systems for hot work or confined spaces
- warning signs and floor markings
- limiting exposure time in noisy or hot areas
- induction and task-specific training
Administrative controls are only as reliable as the people following them. They depend on training, supervision and memory, which is why the law places them below elimination, substitution, isolation and engineering controls.
6. Personal protective equipment (PPE)
PPE protects the individual worker: hard hats, gloves, safety glasses, hearing protection, respirators, high-visibility clothing and fall-arrest harnesses.
PPE sits at the bottom because it doesn't change the hazard at all. It only works if it is the right type, fits properly, is worn correctly every time, and is maintained. If it fails, the worker is exposed to the full hazard. Under the model regulations, a PCBU that directs a worker to use PPE must provide it, make sure it is suitable and fits, and give the worker information, training and instruction on how to use it.
What WHS law says
The hierarchy of controls sits inside a broader legal duty. Under section 17 of the model WHS Act, a duty to ensure health and safety means you must:
- eliminate risks to health and safety so far as is reasonably practicable, and
- if that isn't reasonably practicable, minimise those risks so far as is reasonably practicable.
Regulation 36 then sets out how to minimise a risk you can't eliminate:
- First, minimise the risk by one or more of substitution, isolation and engineering controls.
- If a risk remains, minimise it so far as is reasonably practicable with administrative controls.
- If a risk still remains, minimise it so far as is reasonably practicable with suitable PPE.
Reasonably practicable is defined in section 18. It weighs the likelihood of the hazard or risk, how much harm it could cause, what you know or ought reasonably to know about the hazard and the ways of controlling it, whether suitable controls are available, and, only after all of that, the cost. The cost of a control can only rule it out if it is grossly disproportionate to the risk.
The primary duty belongs to the PCBU. If you aren't sure whether that includes you, read what is a PCBU? Directors and senior managers also have a personal due diligence duty to make sure the business has processes for managing its risks. See officer due diligence under the WHS Act.
What about Victoria?
Victoria has its own Occupational Health and Safety Act 2004, which also requires employers to eliminate risks so far as is reasonably practicable and, where that isn't possible, to reduce them so far as is reasonably practicable. The Occupational Health and Safety Regulations 2017 set out a hierarchy of control for specific hazards, such as hazardous manual handling, plant, falls and noise. The terms differ from the model laws, but the approach is the same: start with the most effective control.
Working through the hierarchy: two examples
Forklifts and pedestrians in a warehouse
Collisions between forklifts and pedestrians cause serious injuries and deaths in Australian workplaces every year. Working through the hierarchy:
- Eliminate: can you remove the need for people to walk through the area at all, for example by moving the dispatch office and amenities so nobody has to cross the loading zone?
- Substitute: could conveyors or pallet jacks do some of the work?
- Isolate: separate walkways with physical barriers, not just painted lines, and create exclusion zones around loading docks.
- Engineer: fit speed limiters, proximity sensors, blue spot lights and reversing alarms.
- Administrative: a traffic management plan, speed limits, visitor sign-in and supervision.
- PPE: high-visibility clothing for everyone on the floor.
Most workplaces end up with a combination, but the physical separation is what does the heavy lifting. High-vis vests on their own would be the weakest possible answer.
Dust from cutting concrete or masonry
Respirable crystalline silica can cause silicosis, lung cancer and kidney disease.
- Eliminate or substitute: order pre-cut or pre-drilled materials, or choose products with lower silica content.
- Engineer: use tools with water suppression or on-tool dust extraction.
- Isolate: keep other workers away from the cutting area.
- Administrative: wet-sweep or vacuum with an H-class vacuum instead of dry sweeping, and run air monitoring and health monitoring.
- PPE: a correctly fitted respirator, fit-tested for each worker.
Learn to manage risks the way regulators expect
Combining controls
In practice you will often need more than one control, and the law allows for this: you can combine controls when no single control is enough. A guarded machine (engineering) still needs a safe operating procedure and training (administrative), and the operator may still need hearing protection (PPE).
The rule is that lower-level controls should support the higher-level ones, not replace them. If your main control for a serious risk is a procedure or PPE, ask whether something higher up the hierarchy is reasonably practicable.
Common mistakes
- Starting at the bottom. Reaching straight for PPE, signs or training because they are quick and cheap, without considering anything higher up.
- Treating training as a control on its own. Training is important, but it doesn't remove the hazard. People get tired, distracted or rushed.
- Paint instead of barriers. Painted walkways are an administrative control. Physical barriers are isolation.
- Not maintaining controls. Regulation 37 requires controls to remain effective. A guard that has been removed, an extraction system that is blocked or a harness past its inspection date gives no protection.
- Never reviewing them. Controls need to be checked, and changed when they stop working.
When to review your controls
Under regulation 38 of the model WHS Regulations, you must review your control measures, and revise them if necessary:
- when a control doesn't control the risk it was put in place to control (for example, after an incident or near miss)
- before a change at the workplace that is likely to create a new or different risk
- when a new relevant hazard or risk is identified
- when the results of consultation show a review is needed
- when a health and safety representative asks for a review
Workers who do the job are often the first to know a control isn't working, and you must consult them when you make decisions about controls.
Quick checklist
- Have we identified the hazards for this task, with the workers who do it?
- Have we genuinely considered eliminating each hazard?
- If not, have we considered substitution, isolation and engineering controls before procedures and PPE?
- Are the controls we chose working, maintained and understood?
- Do we know when we will review them next?
The hierarchy of controls applies whatever the size of your business and whatever state or territory you work in. Used properly, it turns "we told people to be careful" into controls that work even on a bad day.
This article is general information about the model WHS laws, not legal advice. Check the laws, regulations and codes of practice that apply in your state or territory.
