SiliciumHex FieldKit

Problem Solving & Quality · Solutions

Hierarchy of Controls

Rank each countermeasure from strongest to weakest — eliminate, substitute, engineer, organize, protect or inform — and push every option up the ladder.

  • Time30 min
  • FormatSmall group
  • StageSolutions

Hierarchy of Controls: what it is and why it works

The hierarchy of controls ranks countermeasures by how reliably they remove a hazard or a cause, from strongest to weakest: eliminate it, substitute something less hazardous, isolate or engineer it out, apply organizational or administrative measures such as procedures and scheduling, provide protective equipment, and finally inform or warn. The upper levels act on the hazard or cause itself and work regardless of who is on shift. The lower levels depend on people noticing, remembering and complying every time, which is why they fail more often in practice.

Originally an occupational safety principle, the ladder is just as useful for quality and reliability countermeasures, where the common reflex is to retrain the operator or add a warning label. Classifying each option exposes this bias and prompts the question "what would move this one level up?" Often the answer is a simple engineering change, such as a guard, an interlock or an error-proofing device, which links the ladder directly to poka-yoke. Economic and technical feasibility still matter, so the rule is to choose the highest feasible level, combine levels when needed and document why a weaker one was accepted. In a weighted decision matrix, the level on the ladder can become an explicit criterion.

What you need

  • The verified root cause or hazard, described precisely
  • The list of candidate countermeasures from the team
  • Relevant regulations, site safety rules and applicable standards
  • Rough cost, lead time and feasibility information for each option

What you get

  • Each countermeasure classified by level on the hierarchy
  • Improved options pushed one or more levels higher
  • A selected combination of controls with the rationale documented
  • Clear roles for the remaining administrative and PPE measures as supports, not replacements

When to use it

When the proposed fix is “retrain the operator” and “add a warning sign”, again.

How to do it, step by step

  1. List every candidate countermeasure for the verified cause.
  2. Classify each on the ladder: eliminate the hazard or cause, substitute, engineering control, organizational measure, protective equipment or information.
  3. For each option low on the ladder, ask what would move it one level up.
  4. Prefer the highest level that is technically and economically feasible; combine levels when one is not enough.
  5. Document why a weaker level was accepted when stronger ones were rejected.

Worked example: Caustic splashes during drum transfer

Illustrative scenario — figures are realistic but not from a real company.

A chemicals blending plant transferred 50 % sodium hydroxide from 55-gallon drums into a mixing tank using a hand pump and hose. Two eye-splash first-aid cases occurred in one year, despite face shields being required. The first proposal after the second incident was to retrain operators and add signage.

  1. The team listed nine candidate measures and placed each on the ladder. Seven were administrative, PPE or information: retraining, a buddy check, signage, a longer apron, a new face shield model, a written procedure and a toolbox talk.
  2. For each low option, they asked what would move it up. Eliminating the manual transfer was possible by buying caustic in bulk for a fixed tank, with a closed piping connection. A closed-coupling drum pump with dry-break fittings was an engineering alternative.
  3. Substitution with a lower concentration was studied but rejected, because the recipe required it and more drums would have meant more handling.
  4. The team chose bulk delivery to a new tank with a closed transfer line for the long term, and dry-break couplings on drums for the three months before the tank was installed, keeping PPE and the procedure as supporting layers.

Result. Manual open transfers dropped to zero after the tank start-up, with no further splash incidents in the following year. Handling time per batch also fell by about 20 minutes. The written rationale explained why substitution was rejected, which helped during the next safety audit. As always, the new system went through the site's management-of-change and safety review before use.

Open it in the FieldKit Problem Solving app → Get the Problem Solving template pack — join the waitlist

Common pitfalls and how to avoid them

  • Accepting "retrain the operator" as the permanent fix after every incident.Ask what would make the error or exposure impossible; use training to support that measure, not replace it.
  • Classifying an option too generously, such as calling a procedure an engineering control.Ask whether the measure works if nobody remembers it; if not, it is administrative or lower.
  • Choosing a strong control that creates a new hazard, such as a closed transfer that adds a pressure risk.Review each selected control for new risks with a potential problem analysis and the site's change-management process.
  • Dropping PPE once an engineering control is installed, without assessment.Keep lower layers until the residual risk has been reassessed according to site safety rules.

Frequently asked questions

What are the five levels of the hierarchy of controls?

The usual five levels, from most to least effective, are elimination, substitution, engineering controls, administrative controls and personal protective equipment. Some versions, including the one used here, split out information and warnings as the weakest level, below PPE or alongside administrative controls. The principle is the same: prefer controls that act on the hazard itself over those that depend on human behavior.

Can the hierarchy of controls be used for quality problems?

Yes. Replace "hazard" with "cause of the defect". Eliminating the cause might mean removing a process step; substitution, using a more forgiving material; engineering, a fixture or sensor; administrative, a checklist or inspection; information, a label or visual aid. The same bias toward weak measures shows up in quality work, so the ladder is a useful test of any corrective action plan.

Why is PPE considered the least effective control?

PPE does not change the hazard; it places a barrier on the person, and that barrier works only if the right equipment is chosen, fits, is in good condition and is worn correctly every single time. Any lapse leaves the person fully exposed. PPE remains essential for residual risk and during temporary conditions, but it should support higher-level controls, not replace them.

Origin

Hierarchy of controls — occupational safety practice promoted by NIOSH; echoed in the general principles of prevention of EU Directive 89/391/EEC.

Used in these playbooks

Major breakdown investigation 1 week

One week after a trip, a leak or a critical equipment failure: rebuild the sequence, map the failure combinations, dig to the cause, choose strong barriers and record the lesson.

  1. Event Timeline Reconstruction
  2. Fault Tree Analysis
  3. 5 Whys
  4. Hierarchy of Controls
  5. Lessons Learned Register

Related methods

More in “Solutions”

Generate countermeasures that act on the cause and choose between them openly.