Hierarchy of Controls Explained: Better Workplace Risk Assessment with Real Examples
A risk assessment is only as good as the controls it leads to. The hierarchy of controls ranks the ways to reduce risk from most to least effective, and it is built into the international standard for occupational health and safety. This article explains each level with examples and shows how to use a simple risk matrix. For a full OH&S management system, see our ISO 45001 certification service page.
Hazard, risk and control: three words to separate
A hazard is something with the potential to cause injury or ill health, such as a rotating blade, hot surfaces, noise, a wet floor or a vehicle. Risk is the combination of the likelihood that harm will occur and the severity of that harm. A control is anything that reduces either the likelihood or the severity. A cracked pavement is a hazard; the risk depends on how many people walk there, how often, and how badly they could be hurt.
The five levels of the hierarchy of controls
ISO 45001:2018, in clause 8.1.2, requires organisations to eliminate hazards and reduce OH&S risks using a hierarchy: eliminate the hazard, substitute with less hazardous processes, materials or equipment, use engineering controls and reorganisation of work, use administrative controls including training, and use adequate personal protective equipment. The levels are ordered by how reliably they protect people.
1. Elimination
Physically remove the hazard. Examples: design out the need to work at height by assembling components at ground level, remove a trip hazard, stop using a hazardous process altogether. It is the most effective control because nothing is left to fail.
2. Substitution
Replace the hazard with a less hazardous one. Examples: use a water-based cleaner instead of a solvent, replace a heavy tool with a lighter one, use a lower voltage tool. Be sure the substitute does not create a new hazard.
3. Engineering controls
Isolate people from the hazard or reduce exposure through design. Examples: machine guards and interlocks, local exhaust ventilation, edge protection and guardrails, sound enclosures, separating pedestrians from vehicle routes. These work without relying on people to remember anything.
4. Administrative controls
Change the way people work. Examples: procedures and permits to work, training, signage, rotation of staff to limit exposure, scheduling heavy outdoor work outside the hottest hours, inspection and maintenance regimes. These depend on human behaviour and supervision, so they are less reliable than the levels above.
5. Personal protective equipment (PPE)
Gloves, hard hats, safety glasses, hearing protection, respirators and harnesses protect the individual when other controls are not enough. PPE is the last line of defence because it does not remove the hazard, it can be worn incorrectly or not at all, and it depends on fit and maintenance.
One hazard, five answers
| Hazard: falls from height during roof maintenance | Control |
|---|---|
| Elimination | Move equipment to ground level so roof access is not needed |
| Substitution | Use a drone or camera inspection instead of a person on the roof |
| Engineering | Permanent guardrails, anchor points and covered skylights |
| Administrative | Permit to work, trained and authorised staff, weather limits |
| PPE | Full-body harness and lanyard as the final protection |
A simple 5x5 risk matrix
A 5x5 matrix scores likelihood from 1 (rare) to 5 (almost certain) and severity from 1 (negligible) to 5 (catastrophic or fatal). Multiply to get a score from 1 to 25, then group the results:
- 1-4 low: manage by routine procedures.
- 5-12 medium: additional controls and monitoring.
- 15-25 high: do not proceed until risk is reduced; senior attention needed.
Score twice: first the inherent risk (before controls) and then the residual risk (after controls). If the residual score is still high, go back up the hierarchy and look for a more effective control, rather than adding more training or signs. The thresholds are a choice for your organisation; the matrix is a tool to support judgement, not replace it.
A practical risk assessment in six steps
- Break the work into tasks and include routine, non-routine and contractor activities.
- Identify hazards for each task, involving the people who do the work.
- Decide who might be harmed and how, including visitors, contractors and vulnerable groups.
- Evaluate the risk using the matrix.
- Select controls using the hierarchy, record them and assign owners.
- Review after incidents, changes and at planned intervals.
Worker participation matters
ISO 45001 requires consultation and participation of workers. In practice, the person doing the job often knows which control is actually workable. Involving them improves control quality and makes compliance more likely. It also helps you spot controls that look good on paper but are bypassed on site.
Common mistakes
- Jumping to PPE and training without asking whether the hazard can be eliminated or engineered out.
- Confusing hazards and risks in the register.
- Scoring only the inherent risk and never recording residual risk.
- Treating the assessment as a document instead of a conversation on site.
- Failing to review after an incident or a change of equipment or process.
The same prioritisation logic is useful in environmental management. See how it applies in our guide to environmental aspects and impacts. For the history of the standard that introduced these ideas, read the OHSAS 18001 timeline.
Frequently Asked Questions
What is the most effective control in the hierarchy?
Elimination, because it removes the hazard completely and does not depend on people or equipment working correctly.
Is PPE a valid control?
Yes, but it is the last resort. It should be used together with higher-level controls, not instead of them, unless nothing else is reasonably practicable.
What is the difference between a hazard and a risk?
A hazard is a potential source of harm. Risk is the combination of the likelihood and severity of that harm.
Does ISO 45001 require a 5x5 matrix?
No. The standard requires a risk assessment process but does not prescribe the method. A 5x5 matrix is one popular approach.
How often should risk assessments be reviewed?
At planned intervals and whenever there are incidents, changes to processes, equipment or legal requirements.
Related Articles
- OHSAS 18001: History and Withdrawal Timeline, from 1999 to ISO 45001
- Environmental Aspects and Impacts: How to Build a Register That Works
- How to Prepare for an ISO Audit: What Happens in Stage 1 and Stage 2
Need Help? Talk to BRSM Global
BRSM Global supports organisations in Dubai and across the UAE with guidance, implementation, auditing and post-certification support. Explore the related service:
Contact us for a free consultation and quote or call +971 58 623 3144.