Skip to content

Safety guide · Safety management

Hierarchy of controls: the five levels, in order, with floor examples

Short answer

The hierarchy of controls is a ranking of the ways to protect people from a hazard, from most to least effective: elimination, substitution, engineering controls, administrative controls and personal protective equipment (PPE). NIOSH publishes it, and the rule it teaches is simple: start at the top and only move down when the level above cannot be done.

Work the list from the top. First ask whether the hazard can be removed (elimination). If not, can something less hazardous take its place (substitution)? If not, can a guard, enclosure, ventilation or other equipment keep people away from it (engineering)? Then change how people work (administrative), and give people protective equipment (PPE) for whatever risk is left. The top three controls work without anyone having to remember anything. The bottom two depend on people doing the right thing every shift, which is why they come last.

Last reviewed:

The five levels of the hierarchy of controls

NIOSH, the US National Institute for Occupational Safety and Health, lists five levels and orders them by how well they usually work. The order is a rule of thumb for choosing controls, not a score. A well built engineering control can beat a poor substitution, but a team that starts from the top will usually find a better answer than one that starts from the bottom.

The hierarchy of controls with a floor example for each level
LevelWhat it doesExample on a plant floor
1. EliminationRemoves the hazard at its sourceBuy bar stock cut to length so the saw job disappears; move a manual lift to a conveyor so nobody lifts the part
2. SubstitutionReplaces the hazard with a safer oneA water-based cleaner in place of a solvent; a lower-noise tool in place of a loud one
3. Engineering controlsKeeps people away from the hazardFixed guards and interlocks on a press, local exhaust at a weld station, a lift table at an assembly cell
4. Administrative controlsChanges how and how long people are exposedA written procedure, training, job rotation, rest breaks, a permit, floor markings and signs
5. PPEProtects the person while the hazard is still thereSafety glasses, hearing protectors, gloves, respirators, safety shoes

Source: NIOSH, Hierarchy of Controls. Some versions split a level or add isolation as its own level. This guide follows the NIOSH five.

NIOSH's reasoning is about reliability. Elimination, substitution and engineering controls control exposure without much human involvement, so they keep working on a bad day, on night shift and for a new starter. Administrative controls and PPE can lower exposure too, but PPE works only when it is worn correctly and consistently, and administrative controls only while people follow them. NIOSH's advice is not to rely on PPE alone when a better control is available.

What each level means in practice

Elimination and substitution

These two are the strongest and the cheapest to do early. NIOSH notes they are best applied at the design stage, which is the idea behind Prevention through Design: build the safe way into the equipment, the tooling and the layout before they are bought. On an existing line the question is the same, only harder: can the task go, or can the material change? Many teams skip it because they assume the process is fixed. Ask it anyway. A changeover that needs no one inside the guard has no guard hazard.

Engineering controls

Engineering controls put something physical between the person and the hazard: a guard, an interlock, an enclosure, ventilation, a lifting aid. They do not remove the hazard, so they must be inspected and kept in place. The common failure is the guard that gets taken off for a quick job and never goes back. Treat a defeated guard as a finding, and ask why it was in the way. Our machine guarding inspection sheet gives you a place to check them.

Administrative controls

Procedures, training, permits, signs, rotation and rest breaks all sit here. They matter, and some hazards have no better answer, but they rely on people. Lockout is the clearest case: it is an administrative control that protects people from stored energy, and it needs a lock, a procedure and trained staff every time. See the lockout tagout guide. A written procedure is also where a control from a higher level gets its instructions, such as how to check that a guard is fitted.

PPE

PPE is the last line, not the first. It does not change the hazard, and if it fails the person takes the full exposure. That does not make it optional: where a risk remains after the higher controls, OSHA requires employers to provide and enforce it. Our PPE guide covers what OSHA requires, by body part.

How to apply the hierarchy to a hazard

  1. 1

    Name the hazard and who is exposed

    Write one hazard per line: what it is, where, who is near it and for how long. Use your risk assessment or job hazard analysis as the list.

  2. 2

    Ask the elimination question first

    Can the task, the part or the material go? If yes, stop there and write down what changes.

  3. 3

    Try substitution next

    Is there a less hazardous material, tool or method that does the same job? Check that the replacement does not bring in a new hazard.

  4. 4

    Add engineering controls for what remains

    Guard, enclose, ventilate, lift or separate. Name who inspects it and how often.

  5. 5

    Add administrative controls to keep it working

    Write the procedure, train the people and set the check. Do not stop here if a higher level was possible.

  6. 6

    Use PPE for the risk left over, then re-score

    Choose it from a hazard assessment, train people to use it and score the hazard again with all controls in place. If it is still above your accept line, go back up the list.

Record the level next to each control. Looking at an action list sorted by level shows at once if everything sits at the bottom.

Worked example: a noisy deburring station

This example is illustrative. A deburring station runs at 95 dBA for 3 hours a day, and the operator spends 4 more hours at 90 dBA doing finishing work nearby. OSHA 29 CFR 1910.95, Table G-16, permits 4 hours at 95 dBA and 8 hours at 90 dBA. When exposure is mixed, the footnote to the table adds the fractions, and a sum above 1 exceeds the limit. Before any change: 3 / 4 + 4 / 8 = 0.75 + 0.5 = 1.25. That is over the limit.

The same hazard worked down the hierarchy (illustrative)
LevelQuestion askedDecision
EliminationCan deburring go?Not fully. The part needs a clean edge, but a change to the cutting step reduces the burr size, so the work shrinks
SubstitutionA quieter method?Move from handheld grinding to a vibratory tumbler for the small parts
EngineeringCan noise be contained?An acoustic enclosure around the remaining grinder brings the 95 dBA work to 90 dBA
AdministrativeCan time be limited?Rotate the two operators; check the enclosure door is shut at the start of the shift
PPEWhat risk is left?Hearing protectors, selected from several options, fitted and used on the station

The enclosure result is an assumed figure for the example, not a measured one. Measure your own station.

After the enclosure the 3 hours of grinding are at 90 dBA. Now: 3 / 8 + 4 / 8 = 0.375 + 0.5 = 0.875. That is under 1, so the Table G-16 limit is met without leaning on hearing protectors. Seven hours at 90 dBA is still a dose of 87.5 percent of an 8-hour day (7 / 8), and 50 percent already equals 85 dB as an 8-hour average. So the hearing conservation program in 1910.95(c) still applies, and the employer must make hearing protectors available at no cost, 1910.95(i)(1). PPE stays in place for what is left, and the control above it does the main work. The rule behind this order is in paragraph 1910.95(b)(1): feasible administrative or engineering controls first, then PPE if the sound is still over the table. Use the noise dose calculator to check your own numbers.

Where the hierarchy appears in OSHA rules and ISO 45001

Several US rules follow the same order even though they do not use the name. 29 CFR 1910.95(b)(1) requires feasible administrative or engineering controls for noise, with PPE if that does not bring the level down to the table. 29 CFR 1910.134(a)(1) says the primary objective for airborne contaminants is to prevent contamination by accepted engineering controls, such as enclosure, ventilation and substitution of less toxic materials, and that respirators are used when those controls are not feasible, or while they are being put in place. ISO 45001:2018, clause 8.1.2, sets the same order for eliminating hazards and reducing risk. Check your local rules where you work outside the United States.

Common mistakes that push teams to the bottom

  • Starting at PPE or training because they are quick, and never asking the elimination question.
  • Calling a sign or a toolbox talk an engineering control. A control is engineered only if it works when nobody is paying attention.
  • Fitting a guard and not checking it. A guard that is propped open is worse than none, because people think they are protected.
  • Choosing a substitute without checking it for new hazards, such as a safer solvent that is flammable.
  • Closing an action once PPE is issued, without re-scoring the risk.
  • Using one level for the whole plant. A hazard needs a mix, with the strongest control you can do and the rest as backup.

Open a safety tag for a defeated guard or a missing control the day it is found, and track it to closure.

How LeanSuite helps

LeanSuite does not choose controls for you. It helps you keep them running. Safety tags route a reported hazard to an owner and track it until it is fixed. Lockout/Tagout guides authorized staff through each isolation step with a photo of every lock. The Safety Improvement page shows the full set.

Safety Improvement

Report and control hazards in LeanSuite

Workplace safety in manufacturing, run from one platform: report hazards in seconds, fix them with tracked actions, train people and see safety KPIs on your tier boards.

See Safety Improvement

Go deeper

This page is the short version. These guides cover each part in full.

All our articles on this subject are in the safety management topic.

Free templates and tools

Key terms

Lean glossary

Doing this in LeanSuite

See it on your own lines

Bring the problem you are working on to a 45-minute demo. Or look around with sample data first, or pilot LeanSuite on your own lines for 90 days, with the setup done by our team.

Book a 45-minute demoClick through the interactive demoStart a 90-day pilot

FAQ

Questions about hierarchy of controls

  1. The hierarchy of controls is a ranking of ways to protect workers from a hazard, from most to least effective: elimination, substitution, engineering controls, administrative controls and personal protective equipment. NIOSH publishes it. The idea is to start at the top and move down only when the level above cannot be done.

  2. In order: elimination (remove the hazard), substitution (replace it with something safer), engineering controls (keep people away from it with guards, enclosures or ventilation), administrative controls (change how people work, such as procedures, training and rotation) and PPE (equipment worn by the person).

  3. PPE does not change the hazard. It only protects the person who wears it, and only if it is the right type, fits and is worn every time. NIOSH notes that it works only when used correctly and consistently, so employers should not rely on it alone when a better control is available. It is still required where a risk remains.

  4. Elimination removes the hazard completely, for example by no longer using a chemical or by making a task unnecessary. Substitution keeps the task but swaps in something less hazardous, for example a water-based cleaner in place of a solvent. Check a substitute for new hazards before you adopt it.

  5. A fixed guard or interlock is an engineering control, because it works without the operator having to do anything. A rule that says keep your hands clear, or a sign on the machine, is administrative. If a guard can be removed without a tool and stays off, it is only as reliable as the people who put it back.

  6. OSHA does not use that name across all its rules, but some standards follow the same order. For noise, 29 CFR 1910.95(b)(1) requires feasible administrative or engineering controls first, then PPE. For airborne contaminants, 29 CFR 1910.134(a)(1) makes engineering controls the primary measure and respirators the backup. Check your local rules outside the United States.

Related guides and tools

More method guides

Or browse the topics, the full library and the lean glossary.

Rather see it on your own problem?

Bring the problem you are stuck on, and we will show you on a call how LeanSuite handles it.

Schedule Demo

Pass it on

We want LeanSuite to be the best place on the internet for lean help. If this was useful, send it to someone on your team or in your network who needs it.