The hierarchy of controls is the foundation of every effective SWMS. It is the system that determines how you manage a hazard — not just whether you manage it, but how effectively. Controls higher in the hierarchy are more reliable because they do not depend on human behaviour. Controls lower in the hierarchy are less reliable because they require people to consistently follow rules and wear equipment.
This guide explains each of the six levels with real-world construction examples, covers the most common mistakes, and describes how a properly structured SWMS applies the hierarchy to every identified hazard.
Contents
The Hierarchy at a Glance
The hierarchy of controls ranks risk control measures from most effective (top) to least effective (bottom). This ranking is recognised internationally and is embedded in New Zealand’s Health and Safety at Work Act 2015 (sections 30 and 31), Australia’s WHS Act 2011, and the ISO 45001 occupational health and safety standard.
The top three levels (elimination, substitution, isolation) physically remove or separate the hazard. They are the most effective because they do not rely on people remembering to do something. The bottom three levels (engineering, administrative, PPE) manage the hazard but leave it in place. They are less effective because they depend on equipment functioning and people complying.
Level 1: Elimination
Elimination means removing the hazard entirely so it no longer exists. This is the most effective control because if the hazard is gone, there is zero risk from it. Elimination should always be the first question you ask when assessing any hazard.
Construction Examples
- Working at height: Can the work be done from ground level instead? Prefabricating roof trusses on the ground and craning them into position eliminates the need for workers to be at height during assembly.
- Confined space entry: Can the pipe inspection be done using a remote camera or drone instead of sending a worker inside? If the camera achieves the inspection objective, the confined space entry hazard is eliminated.
- Manual handling: Can the heavy materials be delivered directly to the work area by crane or forklift, rather than manually carried by workers? Mechanical delivery eliminates the manual handling hazard.
- Excavation near services: Can the services be relocated or decommissioned before excavation begins? Removing the service eliminates the strike risk.
Key question: “Can we do this task in a way that removes the hazard entirely?” If the answer is yes and it is reasonably practicable, elimination must be your first choice.
Level 2: Substitution
Substitution means replacing a hazardous material, process, or piece of equipment with something less hazardous. The hazard is not eliminated but is reduced to a lower level of risk.
Construction Examples
- Silica dust: Substituting dry-cutting concrete blocks with wet-cutting methods. The cutting still occurs, but the substitution dramatically reduces airborne crystalline silica dust exposure.
- Chemical hazards: Replacing solvent-based paints and adhesives with water-based alternatives. The application process is the same, but the toxicity hazard is substantially reduced.
- Noise: Using electric-powered equipment instead of diesel or petrol-powered equivalents where available. Electric tools typically produce lower noise levels, reducing hearing damage risk.
- Fall hazard: Using a scissor lift or boom lift instead of ladders for work at height. The work is still elevated, but the enclosed platform with guardrails is a significantly safer access method than a ladder.
Level 3: Isolation
Isolation means physically separating people from the hazard. The hazard still exists, but people cannot come into contact with it.
Construction Examples
- Live electrical: Locking out and tagging out (LOTO) electrical supply before working on circuits. The electrical energy still exists in the grid, but the isolation procedure prevents it from reaching the work area.
- Demolition: Establishing exclusion zones around demolition areas with physical barriers and signage, preventing unauthorised access during demolition operations.
- Overhead work: Barricading ground-level areas beneath overhead work to prevent workers from entering the drop zone where tools or materials could fall.
- Traffic management: Physically separating pedestrian and vehicle routes on site using concrete barriers, not just painted lines. A concrete barrier isolates workers from vehicle movements in a way that a painted line cannot.
Level 4: Engineering Controls
Engineering controls use physical barriers, mechanical systems, ventilation, or safety devices to reduce risk. The hazard is still present and workers may be in proximity to it, but the engineering control reduces the likelihood or consequence of harm.
Construction Examples
- Edge protection: Installing guardrails, mid-rails, and toe boards around open edges and floor penetrations. Workers are still at height, but the engineering control prevents falls.
- Ventilation: Installing mechanical extraction ventilation in enclosed spaces where welding, painting, or cutting is being performed. The fumes are still generated, but the ventilation system removes them from the breathing zone.
- Machine guarding: Fitting guards on circular saws, grinders, and other power tools to prevent contact with moving blades. The cutting hazard exists, but the guard prevents the operator’s hands from reaching the blade.
- Safety netting: Installing safety nets below elevated work areas to arrest a fall. The fall can still occur, but the net limits the fall distance and prevents ground impact.
- Trench shoring: Installing hydraulic shores or trench boxes in excavations to prevent collapse. The soil pressure still exists, but the shoring system resists it.
Engineering vs isolation: The distinction between isolation and engineering controls can be subtle. Isolation creates a complete physical separation — the worker cannot contact the hazard at all. Engineering controls reduce risk but may still allow some proximity to the hazard. A locked-out power supply is isolation. A machine guard is an engineering control.
Level 5: Administrative Controls
Administrative controls change the way people work rather than changing the physical environment. They include training, procedures, permits, signage, supervision, job rotation, and scheduling. They are less reliable than physical controls because they depend on human compliance.
Construction Examples
- Permits to work: Requiring a hot work permit before any welding, cutting, or grinding is performed. The permit process ensures fire risks are assessed and extinguishers are on hand.
- Training and certification: Requiring all workers performing tasks at height to hold a current Working at Heights certificate (NZ Unit Standard 23229 or equivalent). Training ensures workers understand the risks and correct procedures.
- Toolbox talks: Conducting a pre-start briefing each morning to discuss the day’s hazards, review the SWMS, and confirm control measures are in place.
- Signage and demarcation: Installing warning signs, hazard boards, and coloured tape to alert workers to specific risks in different areas of the site.
- Job rotation: Rotating workers performing repetitive manual tasks to reduce cumulative musculoskeletal strain.
- Supervision: Assigning a dedicated safety observer for high-risk activities such as crane lifts, confined space entry, or hot work.
Level 6: PPE
Personal Protective Equipment is the last line of defence. It does not prevent the hazardous event from occurring — it reduces the severity of harm to the worker if the event does occur. PPE is the least effective control because it depends entirely on the worker: they must wear it correctly, it must fit properly, it must be maintained, and it must be the correct type and rating for the hazard.
Construction Examples
- Fall arrest: Full body harness with twin-tail lanyard and shock absorber, connected to a certified anchor point rated to AS/NZS 1891. Required when working at height where guardrails or other engineering controls are not practicable.
- Hearing protection: Class 5 earmuffs (AS/NZS 1270) when working near impact drivers, concrete saws, or other equipment exceeding 85 dB(A). Required when engineering controls (silencing, enclosure) cannot reduce noise to safe levels.
- Respiratory protection: P2 particulate respirator (AS/NZS 1716) when cutting, grinding, or drilling concrete, brick, or stone, and extraction ventilation is not available or sufficient.
- Eye protection: Safety glasses (AS/NZS 1337) for general site work, full-face shield for grinding, cutting goggles for dust-generating activities.
- Hand protection: Cut-resistant gloves (AS/NZS 2161) for handling sheet metal, glass, or sharp materials.
PPE is never enough on its own. Under both the HSWA 2015 (NZ, section 31) and the WHS Act 2011 (Australia), a PCBU must not rely on PPE as the sole control unless no other control is reasonably practicable. In practice, there is almost always a higher-order control that can be applied alongside PPE. A SWMS that lists only PPE for a hazard is non-compliant.
Why the Order Matters
The hierarchy exists because not all controls are equally effective. Consider a simple analogy: if water is leaking through your roof, you can either fix the roof (elimination) or put a bucket under the drip (PPE-equivalent). The bucket works, but only if someone remembers to empty it, positions it correctly, and it does not overflow. Fixing the roof solves the problem permanently regardless of human behaviour.
The same principle applies to workplace safety. Controls that physically remove or contain the hazard (levels 1–4) are more reliable than controls that depend on people (levels 5–6). A guardrail prevents a fall regardless of whether the worker is tired, distracted, or poorly trained. A harness only works if the worker puts it on, adjusts it correctly, and clips onto an anchor point.
This is why HSWA 2015 section 30 requires PCBUs to eliminate risks so far as is reasonably practicable, and section 31 prescribes the hierarchy: if elimination is not reasonably practicable, minimise using substitution, isolation, or engineering controls, and only then use administrative controls or PPE.
A properly constructed risk assessment should show that higher-order controls achieve a greater reduction in risk score. If your inherent risk is High (e.g., 16) and your only control is PPE, the residual risk might drop to Medium (e.g., 9) at best. But if you apply engineering controls plus PPE, the residual risk should drop to Low (e.g., 4). This is the quantitative evidence that the hierarchy works.
Common Mistakes
1. Starting at the Bottom
The most common mistake is jumping straight to PPE without considering higher-order controls. This typically happens because PPE is familiar, visible, and easy to specify. “Wear a harness” is a simple instruction. “Redesign the work method to eliminate the fall hazard” requires more thought — but it is dramatically more effective.
When writing a SWMS, always start at elimination and work down. For each hazard, ask the elimination question first. If elimination is not reasonably practicable, document why, then move to substitution, and so on.
2. Single-Level Controls
Specifying only one type of control for a hazard is insufficient. If that single control fails — the harness is not clipped on, the signage is ignored, the training was not completed — there is nothing else protecting the worker. Defence in depth requires multiple levels working together.
3. Generic PPE Lists
Listing “hard hat, hi-vis, safety boots” for every hazard regardless of relevance. These are site-wide minimum PPE requirements, not hazard-specific controls. A PPE control measure should specify the exact type, standard, and rating of PPE required for the specific hazard being managed. “P2 particulate respirator (AS/NZS 1716) for silica dust exposure during concrete cutting” is a hazard-specific PPE control. “Wear PPE” is not.
4. Confusing Control Levels
Misclassifying controls — for example, listing “training” as an engineering control, or “signage” as isolation. Each level has a specific definition. If you are unsure, ask: does this control physically change the environment (engineering), change the way people work (administrative), or protect the individual (PPE)?
The Two-Level Rule
Every hazard identified in a SWMS must have controls from at least two different levels of the hierarchy. This is not just best practice — it is the principle of defence in depth that regulators expect to see.
Consider a fall hazard when working on a commercial roof:
| Control Level | Control Measure |
|---|---|
| Engineering | Install temporary edge protection (guardrails, mid-rails, toe boards) to all open edges before roof access |
| Administrative | Only workers holding current Working at Heights certification permitted on roof. Pre-start briefing to review fall hazards and rescue procedures |
| PPE | Full body harness with twin-tail lanyard connected to certified roof anchor point as secondary fall arrest during edge protection installation |
This example uses three hierarchy levels. The engineering control (guardrails) physically prevents falls. The administrative controls (certification, briefing) ensure workers are competent and aware. The PPE (harness) provides backup protection during the brief period when guardrails are being installed and not yet in place.
For a complete guide on how to write SWMS documents that properly apply the hierarchy, see our SWMS writing guide. For details on how to rate the effectiveness of controls using the risk matrix, see our 5x5 risk matrix guide.
See the Hierarchy Applied Automatically
SafeMethod AI enforces the hierarchy of controls in every SWMS it generates. Every hazard gets controls from at least two hierarchy levels, PPE is never the sole control, and residual risk is calculated to verify effectiveness.
Generate Your First SWMS FreeNo credit card required. 3 free SWMS per month.