Hierarchy of controls

The hierarchy ranks control measures by how reliably they protect people. Controls at the top remove or physically separate the hazard. Controls at the bottom rely on people doing the right thing every time.

• Elimination. Remove the hazard completely, for example by prefabricating at ground level so nobody works at height.

• Substitution. Replace the hazard with something less dangerous, such as a water-based product instead of a solvent-based one.

• Isolation. Separate people from the hazard by distance or barriers, such as exclusion zones around mobile plant.

• Engineering controls. Physical changes to plant, equipment or processes, such as guardrails, on-tool dust extraction or interlocks.

• Administrative controls. Procedures, training, signage, permits and job rotation.

• PPE. Hard hats, harnesses, gloves, respirators and hearing protection.

Safe Work Australia groups these into three levels. Level 1 is elimination. Level 2 is substitution, isolation and engineering controls. Level 3 is administrative controls and PPE.

Under the model Work Health and Safety Act 2011, a person conducting a business or undertaking (PCBU) must eliminate risks so far as is reasonably practicable, and if that is not possible, minimise them so far as is reasonably practicable.

The model WHS Regulations then set out the order. If a risk cannot be eliminated, the PCBU must minimise it by substitution, isolation or engineering controls, or a combination. If a risk remains, it must be minimised using administrative controls, and then PPE for whatever risk is left. Most states and territories have adopted this wording. Victoria's Occupational Health and Safety Regulations 2017 apply a similar hierarchy to specific hazards such as falls, so check the regulation that covers your hazard.

In practice, you rarely rely on a single control. A good SWMS or JSA usually combines several, starting as high up the hierarchy as is reasonably practicable and adding lower-level controls to deal with the risk that remains.

Take silica dust from cutting concrete. Elimination might mean designing the penetration in before the pour. If cutting is still needed, the next step is engineering controls such as wet cutting or on-tool extraction. Administrative controls then cover who can be in the area and for how long, and respiratory protection is the final layer, not the first.

• Going straight to PPE. PPE is the least effective control. It is the last line of defence, not the plan.

• Treating training as a control on its own. Training and signage are administrative controls. They support higher controls but rarely manage a serious risk by themselves.

• Ignoring design. The biggest gains come at design and planning stage, before anyone is on site.

• Not checking the controls work. Controls must be maintained and reviewed, especially after an incident or a change in the work.