The hierarchy of controls is a ranked list of ways to deal with a hazard: eliminate it, substitute something less dangerous, engineer it out, manage it with procedures, and only then rely on personal protective equipment. The higher a control sits, the less it depends on people doing the right thing every time. Most Canadian OHS laws expect employers to work down the list in that order.
The five levels
Each level answers the same question in a different way: how do we stop this hazard from hurting someone?
- Elimination. Remove the hazard entirely. Bring the work down to the ground instead of working at height, or stop using a chemical the process no longer needs.
- Substitution. Replace the hazard with something less harmful. A water-based coating instead of a solvent-based one, or a smaller, lighter container that is easier to lift.
- Engineering controls. Physically separate people from the hazard. Machine guards, guardrails, local exhaust ventilation, interlocks, sound enclosures and lifting aids all fit here.
- Administrative controls. Change the way people work. Written procedures, permits, training, signage, job rotation, scheduling and supervision.
- Personal protective equipment (PPE). Equipment worn by the worker, such as respirators, hearing protection, gloves, harnesses and safety eyewear.
The order matters because reliability drops as you move down. A guardrail protects everyone who walks past it, whether they are paying attention or not. A harness only protects the person wearing it, if it fits, if it is inspected, if it is connected to a suitable anchor, and if a rescue plan exists.
What the law expects
Provincial OHS laws in Alberta, British Columbia and Ontario all require employers to assess hazards and control them. Alberta's OHS Code is explicit: hazards are to be eliminated where reasonably practicable, and where that is not possible they are controlled using engineering controls, then administrative controls, then PPE, or a combination. British Columbia's OHS Regulation and Ontario's framework set out similar expectations, though the wording and structure differ. Check the current version of your province's rules, and any industry-specific requirements that apply to your work.
Management system standards such as CSA Z45001 (the Canadian adoption of ISO 45001) also build the hierarchy into how hazards are handled.
Applying it to a real hazard
Take a maintenance crew that cleans a dusty process area with compressed air and brooms once a week. A quick walk down the hierarchy might look like this:
- Eliminate: can the process change so less dust is produced or released in the first place?
- Substitute: use a vacuum fitted with a suitable filter instead of dry sweeping and blowing dust into the air.
- Engineer: add or repair dust collection at the source, enclose the transfer point that generates most of the dust.
- Administer: schedule cleaning when fewer people are in the area, train the crew on the method, post the procedure.
- PPE: provide respirators selected for the contaminant, with fit testing and a respiratory protection program behind them.
In practice you usually end up with a combination. The aim is to push as much of the risk reduction as possible into the upper levels so that the lower ones are a backstop rather than the main defence.
Common mistakes
Starting at the bottom
PPE is quick to buy and easy to document, so it is often the first answer. That is the wrong way round. If a hazard assessment lists only PPE as the control, ask what was considered higher up and why it was ruled out.
Treating training as a control on its own
Training is necessary, but it does not stop an exposure by itself. A trained worker beside an unguarded shaft is still beside an unguarded shaft.
Forgetting the new hazards a control creates
A guard that has to be removed for routine cleaning invites people to leave it off. A new enclosure may create a confined space. Every control needs a second look for side effects. This is where a proper hazard assessment earns its keep.
Not checking that controls still work
Ventilation fans fail, interlocks get bypassed, procedures drift. Build inspection and maintenance of controls into your program, and review them after any incident or change.
Recording and checking the controls you choose
A control that is not written down tends to be forgotten, and one that is never checked tends to stop working. For each significant hazard, the hazard assessment should show which levels were considered, what was chosen, and how you will know it is still doing its job.
| Level | Typical example | How to confirm it still works |
|---|---|---|
| Elimination or substitution | Task moved to ground level; less hazardous product in use | Check purchasing and work methods have not drifted back to the old way |
| Engineering | Machine guard, local exhaust, guardrail | Scheduled inspection, airflow or function checks, maintenance records, interlock tests |
| Administrative | Written procedure, permit, job rotation | Field observations, permit reviews, worker feedback, refresher training |
| PPE | Respirator, hearing protection, harness | Fit testing, pre-use inspection, storage and replacement records |
A simple way to work through a hazard and leave a useful record:
- Describe the hazard and who is exposed. Note the task, how often it is done, and the people involved, including contractors and visitors.
- Ask the elimination question first. Record what was considered, even if it was rejected, and why.
- Go down the levels in order. For each one, list the options and whether they are reasonably practicable.
- Choose a combination. Name the primary control and the backstops behind it.
- Look for side effects. Note any new hazard the control creates and how that is handled.
- Assign an owner and a check. Who maintains the control, and how often it is inspected or reviewed.
Workers who do the task are often the best source of higher-level ideas. They know which guard gets removed and why, and which step could be designed out. Involve them, and involve your health and safety committee or representative where you have one.
"Reasonably practicable" is not a loophole. It means weighing the risk against the time, cost and effort of a control. A higher-level control can only be set aside when the effort is clearly out of proportion to the risk, and you should be able to explain that decision in writing.
Where it shows up elsewhere
The same logic appears in many specific programs. The fall protection hierarchy ranks guardrails above travel restraint and fall arrest. Lockout is an administrative control backed by engineered isolation points. Respirators and hearing protection sit at the bottom of their respective programs for good reason.
How ehZee can help
ehZee's safety programs practice works with employers to review hazard assessments and check that the controls chosen follow the hierarchy and are realistic for the site. We start by asking why you need the program and what the work actually involves. See safety program development and review for how that works.
Common questions
Is PPE ever the right answer?
Yes, often as part of a combination, and sometimes as the main control for short, non-routine tasks where nothing higher up is practicable. It should be a deliberate choice, recorded in the hazard assessment, and supported by fit, training, inspection and maintenance.
Do I need to redo the analysis for every task?
You need a hazard assessment that covers the work, and it should be revisited when tasks, equipment, materials or sites change, and after incidents. Many employers use a formal assessment for routine work and a short field-level assessment before each job.
Where do permits fit?
Permits such as hot work or confined space entry permits are administrative controls. They work by forcing a check that the other controls are in place before the work starts.
Can a single control count at more than one level?
Some controls blend levels. A lockout procedure is administrative, but it relies on engineered isolation devices. Classify each part honestly, because the engineered part is usually the more reliable piece and deserves the most attention in inspections.