Hierarchy of Safety Controls in Australian Workplaces

What are the hierarchy of controls?

The hierarchy of controls is a ranked framework for choosing workplace risk control measures, ordered from the most reliable to the least reliable. It directs duty holders to remove a hazard at its source first and to treat protective equipment as the final layer rather than the first response.

The framework applies to any hazard surfaced by a risk assessment. The difference between hazards and risks matters here, because the hierarchy acts on the hazard itself while the risk assessment measures the likelihood and severity of the harm it could cause.

Safe Work Australia, the national policy body for work health and safety, promotes the hierarchy as the standard method for meeting the duty to eliminate or minimise risk. State and territory regulators publish their own versions of the same model.

What are the levels of the hierarchy of control measures?

The hierarchy of controls has five widely used levels: elimination, substitution, engineering controls, administrative controls and personal protective equipment. Australian guidance often splits isolation out as a level of its own, which produces the six-level version of the same model.

Reliability falls as you move down the list. Controls near the top hold up without daily supervision, while controls near the bottom stop working the moment a procedure is skipped or a mask comes off.

Why do some sources list five levels and others six?

Published versions differ because isolation is sometimes treated as a separate level and sometimes grouped with engineering controls. Both versions describe the same sequence of decisions.

The five-level model, common in international guidance, folds isolation into engineering controls on the basis that both physically separate people from the hazard. The six-level model keeps them apart, because isolation relies on a barrier or distance while engineering controls change the plant or process itself.

WorkSafe Victoria uses a four-tier structure, grouping substitution, isolation and engineering together as ways to reduce risk once elimination has been ruled out. The tier count carries no legal weight. The obligation is the sequence: attempt elimination first, then work downwards.

The distinction matters most when managing invisible workplace hazards such as noise, fumes and fatigue, where a physical barrier and a process redesign produce very different results.

Why is PPE the least effective control measure?

PPE ranks last because it leaves the hazard in place and protects only the person wearing it, only while it is worn correctly. Every other level reduces either the hazard or the exposure.

PPE fails in predictable ways:

• Fit. Poorly fitted respirators and harnesses deliver far less protection than their rating
• Compliance. Protection disappears the moment gear is removed for comfort or speed
• Maintenance. Damaged or expired equipment offers false reassurance
• Scope. Only the wearer is protected, not colleagues working nearby

PPE remains necessary in most workplaces and usually sits alongside higher-order controls as a final layer. Relying on it alone leaves the underlying hazard uncontrolled and falls short of what a safe working environment requires under Australian WHS law.

Are the hierarchy of controls a legal requirement in Australia?

Yes. Under the model Work Health and Safety Regulations, duty holders must eliminate risks so far as is reasonably practicable, and where that is not possible, minimise them using the hierarchy of control measures. Regulation 36 sets out the ranked order.

The duty sits with the PCBU, the person conducting a business or undertaking. PCBU responsibilities for health and safety cover selecting controls, consulting workers and health and safety representatives, and reviewing whether those controls still work.

Reasonably practicable is weighed against several factors:

• Likelihood. How probable the hazard or risk is
• Severity. The degree of harm that could result
• Knowledge. What is known about the risk and the available controls
• Cost. Whether the cost is grossly disproportionate to the risk

Obligations are not identical across the country, and psychosocial duties in particular vary, so check the psychosocial hazards legislation by state that applies to your operations.

How to apply the hierarchy of controls in four steps

Applying the hierarchy follows the standard risk management process: identify, assess, control, review. Consultation with workers runs through every step.

1. Identify hazards

Inspect the workplace, review incident and near-miss reports, and ask workers directly. Physical, chemical, biological, ergonomic and psychosocial hazards all belong in the same register.

2. Assess the risk

Judge how likely harm is and how serious it would be. A structured psychosocial risk assessment does for psychological risk what a plant risk assessment does for machinery.

3. Select and implement controls

Start at elimination and move down only where a higher control is not reasonably practicable. Record why each higher option was ruled out, because that reasoning is what a regulator will ask to see.

4. Review the controls

Check that controls still work after changes to plant, staffing or workload, and after any incident. Identifying psychosocial hazards at work early keeps the review cycle useful rather than procedural.

How the hierarchy of controls applies to psychosocial hazards

The duty to eliminate or minimise risk covers psychosocial hazards as well as physical ones, and the hierarchy is the accepted method for working through them. Control measures target work design rather than equipment.

Psychosocial hazards include high job demands, low job control, poor support, bullying and exposure to traumatic material. The hierarchy translates them into the same ranked decisions:

• Eliminate. Remove an unnecessary task or an unsafe shift pattern entirely
• Substitute. Replace a high-exposure duty with a lower-exposure equivalent
• Engineering. Redesign workflow, rosters, caseloads or physical work conditions
• Administrative. Add supervision, training, escalation paths and job rotation
• Support services. Provide counselling, EAP access and post-incident debriefing

Counselling and support sit at the bottom for the same reason PPE does, because they help after exposure rather than reducing it. Guidance on how to manage psychosocial hazards sets out the higher-order options in detail.

FAQs

Can you use more than one level of control at the same time?

Yes. Combining controls from different levels is standard practice and usually produces the strongest result. A metal workshop might remove unnecessary cutting tasks, install extraction ventilation, train staff in safe operation and issue P2 respirators. Layering controls means the failure of one measure does not leave workers exposed.

Who is responsible for applying the hierarchy of controls?

The PCBU holds the legal duty, which covers business owners, employers and anyone with management or control of a workplace. Managers, supervisors and health and safety representatives assist with selecting and monitoring controls. The obligation to provide safe systems of work cannot be delegated away.

What does so far as is reasonably practicable mean?

It means doing what is reasonably able to be done to eliminate or minimise a risk, weighed against likelihood, severity, available knowledge, available controls and cost. Cost justifies a lower-order control only where it is grossly disproportionate to the risk. Inconvenience and preference carry no weight.

How often should control measures be reviewed?

Review controls whenever the work changes, after an incident or near miss, when a new hazard is identified, and at scheduled intervals. Workplaces with high turnover or fluctuating workloads generally need shorter review cycles. Worker feedback is usually the earliest reliable signal that a control has stopped working.

What is the difference between isolation and engineering controls?

Isolation places a barrier or distance between the worker and the hazard, such as enclosing a machine or operating it remotely. Engineering controls change the plant, process or environment itself, such as adding guarding or extraction ventilation. Several published models group the two together as a single tier.

Does the hierarchy of controls apply in Victoria?

Yes, although the legal basis differs. Victoria operates under the Occupational Health and Safety Act 2004 rather than the model WHS laws, and requires employers to eliminate risks so far as is reasonably practicable and reduce them where elimination is not possible. WorkSafe Victoria publishes a four-tier version of the hierarchy.

Safer work takes more than a control list on the wall. Foremind helps Australian organisations identify, assess and manage risk to psychological health with tools built for the job. Visit Foremind to see how it works.

‍