The Hierarchy of Control Explained for Trades
If you've filled in a risk assessment, you've probably seen the phrase "hierarchy of control." But what does it actually mean in practice, and are you applying it in the right order? Get this wrong and your RAMS is little more than a paper exercise. Get it right and you've got a genuine framework for keeping yourself and others safe.
What Is the Hierarchy of Control?
The hierarchy of control is a ranked set of measures for reducing risk, ordered from most to least effective. It isn't a checklist you pick from freely — it's a priority sequence. You work down the list only when the measure above it is not reasonably practicable.
The legal foundation is Regulation 3 of the Management of Health and Safety at Work Regulations 1999, which requires every employer (and self-employed person) to make a suitable and sufficient risk assessment and act on it. The hierarchy is the framework for that action.
The five levels are:
| Level | Measure | What it means |
|---|---|---|
| 1 | Eliminate | Remove the hazard entirely |
| 2 | Substitute | Replace it with something less hazardous |
| 3 | Engineering controls | Physical measures that reduce exposure |
| 4 | Administrative controls | Systems, procedures and training |
| 5 | PPE | Last resort — protects only the individual |
Level 1 — Eliminate
This is the only measure that removes the risk completely, which is why it sits at the top. Ask yourself: does this task actually need to happen at all? Can the hazard be designed out?
Example: You're asked to drill into a wall to run cables. Before starting, you use a cable and pipe detector and re-route the cable run to avoid drilling near live services altogether. The drilling hazard is eliminated for that section.
In construction, CDM 2015 places a specific duty on principal designers to eliminate foreseeable risks at the design stage — before anyone sets foot on site.
Level 2 — Substitute
If you can't eliminate, can you swap the hazardous material or method for something safer?
Example: A painter switches from a solvent-based product to a water-based equivalent with a lower VOC content. Under COSHH 2002, substitution is explicitly the first control measure to consider once a hazardous substance has been identified. Using a less harmful substance is always preferable to trying to manage a more harmful one.
Substitution is also commonly used in work at height — using a podium steps rather than a traditional ladder, for instance, because a podium provides a more stable working platform.
Level 3 — Engineering Controls
These are physical controls built into the work environment or equipment. They don't rely on people doing the right thing every time — which is why they outrank administrative controls.
Examples include:
- Local exhaust ventilation (LEV) to capture dust or fumes at source
- Blade guards on circular saws and bench-mounted tools
- Edge protection and collective fall arrest systems on roofs and elevated platforms
- Prop and brace systems in excavations to prevent collapse
Under the Work at Height Regulations 2005, the preference is always for collective protection (edge protection, guard rails, working platforms) over individual protection (harnesses). That's engineering and collective measures taking precedence over PPE.
Level 4 — Administrative Controls
These manage how work is done — procedures, permits, training, supervision and safe systems of work. They are valuable, but they rely entirely on people following them correctly, every time. That's why they sit below engineering controls.
Examples include:
- Permit-to-work systems for confined spaces or hot work
- Restricting access during high-risk operations
- Toolbox talks and task-specific training
- Scheduling noisy work during hours when fewer people are present
- Rotating workers to limit exposure time to vibration or noise
A method statement — the MS part of your RAMS — is an administrative control. It describes the sequence of work and the controls in place. Writing it doesn't protect anyone unless the controls in it are actually implemented.
Level 5 — PPE
PPE is last in the hierarchy, not because it's unimportant, but because it only protects the person wearing it and it can fail. A glove can tear. A respirator can be poorly fitted. PPE does nothing to reduce the hazard itself.
The Personal Protective Equipment at Work Regulations 1992 (updated in 2022) require PPE to be provided where risk cannot be adequately controlled by other means. The phrase "adequately controlled" is the key — you must genuinely have worked through levels 1–4 first.
PPE should always be selected for the specific risk, properly fitted, maintained, and used alongside — not instead of — higher-order controls.
Applying This to Your Risk Assessments
When you write a risk assessment, go through the hierarchy in order for each significant hazard. Document why you've moved past a higher level if it wasn't reasonably practicable. A common mistake is jumping straight to PPE because it's the most visible and familiar measure — but that won't satisfy a regulator or an insurer reviewing your documentation after an incident.
A practical rule: if your only control is PPE, your risk assessment isn't finished.
Work through the hierarchy genuinely, record your reasoning, and your risk assessments will reflect what the HSE actually expects to see.