What Are the Hierarchy of Controls in WHS

A crew is drilling overhead inside a live switchboard room. Everyone has earplugs, a harness and a signed permit, yet the main risk remains. The stronger decision would be to de-energise the board, or schedule the work after shutdown. That difference captures the point of the hierarchy of controls: the order in which you select controls matters.

For Australian PCBUs, the hierarchy links hazard control to the duty to eliminate or minimise risk so far as is reasonably practicable. It also gives H&S managers a practical way to test whether an SWMS, risk assessment or control plan deals with the hazard at its source, or places more responsibility on workers.

Table of Contents

• The Hierarchy of Controls in Plain English
• The Five Levels from Elimination to PPE
  • Elimination
  • Substitution
  • Isolation and engineering controls
  • Administrative controls
  • PPE
• Why the Order Matters Under WHS Law
  • What this means for an SWMS
• Hierarchy of Controls in Practice on Site
  • Construction, working at height
  • Manufacturing, line operation
  • Industrial services, confined space
• Applying the Hierarchy to Psychosocial Hazards
  • Jurisdiction still matters
• Documenting Controls in the Right Order
• Getting the Hierarchy Right and Staying Defensible
  • Common reasons control plans fail review

The Hierarchy of Controls in Plain English

The hierarchy of controls is a ranked WHS decision framework for eliminating or minimising exposure to hazards. Safe Work Australia describes the controls as ordered from the highest level of protection and reliability to the lowest, with elimination as the most effective control. The model is formalised in the Safe Work Australia model code for managing WHS risks, which remains the reference point for duty holders in Australia in 2026.

The framework isn't a menu where a supervisor selects whichever control is easiest. You start at the top, test whether the hazard can be eliminated, then work down only when the higher control isn't reasonably practicable or doesn't fully control the residual risk.

The standard model has five levels:

• Elimination, remove the hazard entirely.
• Substitution, replace it with a lesser risk.
• Engineering controls, change the plant, workplace or process to separate people from the hazard.
• Administrative controls, change work methods, instructions or scheduling.
• Personal protective equipment, protect the worker from exposure that remains.

Australian procedures often show isolation as a separate practical layer between substitution and engineering. Safe Work Australia's construction guidance also separates isolation, which makes the sequence easier to apply in SWMS and site planning. Isolation can include creating a physical exclusion zone, separating people from traffic, or preventing access to energised plant.

The switchboard example exposes a common failure. Earplugs reduce noise exposure and a harness may reduce fall consequences, but neither removes the live electrical hazard or changes the work environment. A permit and toolbox talk can improve coordination, but they still rely on people recognising the hazard and following the process under real site conditions.

Practical rule: If the control depends mainly on a worker remembering, choosing or correctly wearing something, check whether a higher-order control is available first.

The Five Levels from Elimination to PPE

Each level answers a different question. The strongest controls change the task or hazard. The weaker controls manage the worker's interaction with a hazard that still exists.

Elimination

Elimination removes the hazard or the task that creates exposure. It isn't enough to move the hazardous activity to another area, give it to a contractor, or add a warning sign.

A construction team might eliminate work at height by assembling a façade component at ground level before lifting it into position. A manufacturing plant might eliminate a solvent-cleaning step by changing the production method. In both cases, the exposure disappears from the original task rather than being managed through worker behaviour.

Substitution

Substitution replaces the hazard with a less harmful material, plant item or process. The replacement needs its own risk assessment. A water-based adhesive may reduce solvent exposure, but it can introduce different handling, curing or slip hazards if the process isn't reviewed.

An Australian workshop might replace a solvent-based adhesive with a water-based product, then confirm that the new product performs adequately and doesn't create a different unacceptable risk. Substitution is only a genuine improvement when the overall risk falls.

Isolation and engineering controls

Isolation separates people from the hazard. Engineering controls change the physical design of the plant, work area or process. Depending on the procedure being used, isolation may be listed separately, but both approaches aim to reduce exposure without relying primarily on worker choices.

Examples include a fixed guard on a press, an interlocked access door, local exhaust ventilation, a noise enclosure, a barrier around an excavation or a mechanical lifting aid. Safe Work Australia's current model code on managing WHS risks notes that engineering controls should change the work area, tool, load, environment or handling method to reduce the frequency, magnitude or duration of harmful exposure.

Administrative controls

Administrative controls change how work is planned or performed. They include SWMS instructions, permits, training, supervision, signage, inspections, job rotation, fatigue rules and scheduling.

They have a legitimate role, particularly where higher controls can't fully remove exposure. But a procedure doesn't physically prevent a person entering a danger zone, and training doesn't guarantee correct behaviour during fatigue, production pressure or an unusual task.

PPE

PPE creates a barrier between the worker and the remaining hazard. It includes hearing protection, respirators, gloves, eye protection, fall-arrest equipment and protective clothing.

PPE is essential in many tasks, but it remains the least reliable layer because it depends on selection, fit, inspection, maintenance and consistent use. It should supplement stronger controls, not conceal the absence of them.

A practical comparison is set out below. For more examples across common workplace hazards, see these hierarchy of control examples.

Why the Order Matters Under WHS Law

A PCBU can't treat the hierarchy as a preference list detached from its legal duty. Under the model WHS framework, the control process starts with elimination. If elimination isn't reasonably practicable, the PCBU must work through substitution, isolation and engineering controls before relying on administrative controls and PPE.

Safe Work Australia's guidance on controlling WHS risks makes the staged logic clear. After applying reasonable higher-order controls, the PCBU must consider administrative controls, and then PPE if risk remains. You don't stop at the first control that looks acceptable when residual risk is still present.

The reasonably practicable test requires more than choosing the cheapest option. The PCBU considers the likelihood and potential degree of harm, what is known about the hazard and available controls, and the cost of implementing further controls, including whether that cost is grossly disproportionate to the risk. The decision should be recorded, especially where a higher-order control was considered and rejected.

What this means for an SWMS

An SWMS that starts with “wear PPE, follow the procedure and sign on” doesn't demonstrate that the PCBU tested elimination, substitution, isolation or engineering options. It may describe worker expectations, but it doesn't show why those controls are sufficient.

A defensible SWMS should explain the control decision in sequence. For officers and managers reviewing whether people can safely perform work, the WHS duties of a person conducting a business or undertaking provide useful context for connecting operational decisions to the PCBU's duty.

Health surveillance and occupational assessments can support risk management, particularly where residual exposure affects worker capacity. They don't replace source controls. A practical reference on that boundary is this occupational health assessment guide from Cartwright Fitness.

Hierarchy of Controls in Practice on Site

The highest reasonably practicable control changes with the work, but the ranking doesn't. A construction supervisor, production manager and confined-space coordinator may choose different engineering solutions, yet each should start by asking whether the hazard can be removed.

Construction, working at height

A construction team should first consider whether the work can be completed at ground level through prefabrication or changed sequencing. If people must work at height, fixed edge protection, properly designed platforms and void covers should sit ahead of personal fall protection.

A harness may protect a worker after a fall begins. It doesn't stop the person reaching the edge. Guardrails, covers and platform design address the exposure earlier in the chain.

Manufacturing, line operation

Manufacturing controls usually become visible in the plant design. Fixed guards, interlocks, light curtains and safe access arrangements can prevent contact with moving parts while allowing the line to operate.

Isolation and lockout procedures remain necessary for maintenance, cleaning and fault finding. The physical design should support isolation rather than rely on a worker finding the correct switch under pressure. PPE still has a role, but it shouldn't compensate for missing guarding or poor machine design.

Industrial services, confined space

Confined-space work requires a careful distinction between controls. The first question is whether entry can be eliminated through remote inspection, external cleaning or redesigned access. If entry remains necessary, atmospheric monitoring and mechanical ventilation may act as engineering controls, while entry permits, communication protocols, standby arrangements and rescue plans sit within administrative controls.

The comparison below shows how the same logic produces different measures.

Applying the Hierarchy to Psychosocial Hazards

The hierarchy applies to psychosocial hazards, but the controls look different because the source may be workload, work design, interpersonal conduct or organisational systems. Telling a worker to build resilience doesn't remove an unreasonable workload. Coaching a supervisor doesn't by itself remove abusive customer contact.

Elimination means removing the source where practicable. That could involve stopping a harmful client relationship, removing an unrealistic work demand, or discontinuing a work arrangement that creates repeated exposure. Substitution may involve changing rosters, communication channels, reporting lines or task allocation.

Engineering controls can still be system-based rather than mechanical. Examples include workload dashboards, after-hours email blocking, automated allocation rules and case management systems that prevent one worker from carrying unmanaged demand. Administrative controls then support the system through role clarity, debrief protocols, complaint procedures and trained contact officers.

EAP access, resilience training and peer support can help workers deal with residual effects, but they sit at the lower end of the hierarchy. They shouldn't be the organisation's only response to a work design problem. A structured psychosocial risk assessment approach can help teams identify the source and connect controls to the work system.

Jurisdiction still matters

National guidance presents the classic model, but Australian jurisdictions don't apply psychosocial controls in exactly the same way. NSW, Queensland, South Australia and the Commonwealth are described as requiring higher-order controls before lower-order measures, while Victoria uses a modified approach in which information, instruction or training can't be the exclusive or predominant control.

Victoria's Occupational Health and Safety framework includes mental health duties that overlap with broader WHS risk management. Organisations operating across states should therefore avoid using one generic psychosocial procedure without checking the applicable regulator and legislation.

NSW has a further compliance change to plan for. From 1 July 2026, the NSW psychosocial code is described as becoming a standalone enforceable duty under s26A, increasing the importance of documented control selection for NSW PCBUs. Treat that date as a planning milestone, not a reason to wait before improving controls.

Documenting Controls in the Right Order

A regulator, principal contractor or auditor should be able to read the control decision from top to bottom without reconstructing it from emails. Start with the hazard and exposed people. Then record the highest control considered, whether it was adopted, and the evidence supporting the decision.

For each lower-order measure, state why it was needed after the higher-order control. Link design drawings, plant specifications, isolation records, procedures, training registers and PPE issue logs to the control they support. Don't attach a training register to an engineering control and imply that training makes the guard effective.

Use a consistent hierarchy column in the SWMS or risk register. That makes gaps visible, particularly where a risk assessment contains several administrative controls but no recorded consideration of elimination, substitution or engineering options.

The Safe Work Australia guide on reasonably practicable control decisions supports this evidence-based approach. The document should show a decision sequence, not just a completed checklist.

Getting the Hierarchy Right and Staying Defensible

The hierarchy gives practical shape to the PCBU's primary duty under sections 19 and 28 of the WHS Act. Section 19 places the primary duty on the PCBU to ensure, so far as is reasonably practicable, the health and safety of workers and others affected by the work. Section 28 also requires workers to take reasonable care and follow reasonable instructions, but worker duties don't transfer the PCBU's responsibility for designing effective controls.

A defensible decision trail has three features. It considers the levels in order, records why a higher control wasn't reasonably practicable, and combines controls where residual risk remains. The construction code confirms that PCBUs must use the hierarchy when selecting controls for construction work, including isolation as a distinct step before engineering controls. See the Safe Work Australia construction work model code when reviewing construction SWMS and site planning.

Common reasons control plans fail review

• PPE comes first: The SWMS prescribes equipment without showing why the task can't be eliminated or redesigned.
• Training carries the risk: The organisation relies on induction, a toolbox talk or a competency sign-off where a physical control is available.
• The wording is generic: “Follow safe work practices” doesn't identify the hazard, control owner or verification method.
• Consultation is missing: The record doesn't show how affected workers contributed to the control decision.
• Reviews don't happen: The risk assessment stays unchanged after an incident, plant modification, process change or new information.

Keep the control rationale, review dates and consultation records together. A SafeWork inspector or principal contractor should be able to verify the decision trail in minutes, not days. If the higher-order controls were rejected, the reason needs to be specific, evidence-based and connected to the reasonably practicable test.

Safety Space provides digital tools for risk assessments, forms, accountability and multi-site oversight, which can help teams keep hierarchy-based control decisions and supporting records together. Visit Safety Space to review how its H&S management platform can support your SWMS, risk register and control verification process, then arrange a demo or consultation focused on your current hazards.