The hierarchy of risk control is a five-level framework — elimination, substitution, engineering controls, administrative controls, and personal protective equipment — used to decide how to reduce a workplace risk. UK employers must consider these levels in order, starting with elimination, and can only rely on a lower-order control once they have shown that a higher-order one is not reasonably practicable. This framework is set out in Schedule 1 of the Management of Health and Safety at Work Regulations 1999 (MHSWR 1999) and underpins every risk assessment.
What is the hierarchy of risk control?
The hierarchy of risk control (also called the hierarchy of controls or hierarchy of control measures) ranks risk reduction measures from most effective to least effective. It exists because not all controls are equally reliable — a control that removes a hazard entirely will always be more effective than one that relies on a worker remembering to wear equipment correctly. The five levels, in order of preference, are:
- 1. Elimination — remove the hazard entirely
- 2. Substitution — replace the hazard with something less dangerous
- 3. Engineering controls — physical measures that isolate people from the hazard
- 4. Administrative controls — changes to how work is organised and carried out
- 5. Personal protective equipment (PPE) — equipment worn by the individual, used only as a last resort
This ordering is not a suggestion — it is the legal standard against which HSE inspectors, courts and tribunals judge whether a risk assessment is suitable and sufficient.
The legal basis: MHSWR 1999 Schedule 1
Every employer has a duty under Regulation 3(1) of MHSWR 1999 to assess risks to employees and others affected by their work. Once a risk has been identified, Schedule 1 of MHSWR 1999 sets out the "general principles of prevention" that must guide the choice of control measures. These principles require employers to avoid risks where possible, evaluate risks that cannot be avoided, combat risks at source, and adapt work to the individual — before finally giving collective protective measures priority over individual measures such as PPE. This is the legal origin of the hierarchy of controls used across UK health and safety practice.
Sector-specific regulations reinforce the same ordering. Under the Control of Substances Hazardous to Health Regulations 2002 (COSHH), employers must prevent exposure to a hazardous substance or, where prevention is not reasonably practicable, adequately control it — working through elimination and substitution before relying on respiratory protective equipment. The Work at Height Regulations 2005 require employers to avoid work at height where possible, use equipment or measures to prevent falls (such as guardrails), and only then use equipment to minimise the distance and consequences of a fall, with PPE such as a harness treated as a lower-order control.
The five levels explained with examples
1. Elimination
Elimination removes the hazard so that the risk no longer exists at all. Example: redesigning a delivery process so that goods no longer need to be lifted manually, or removing a step ladder task entirely by relocating equipment to ground level. Because the hazard is gone, this is the only control that offers complete protection.
2. Substitution
Substitution replaces a hazard with something less dangerous. Example: replacing a solvent-based adhesive with a water-based one, or replacing a heavy component with a lighter material to reduce manual handling risk. The hazard still exists in some form, but the level of risk is reduced.
3. Engineering controls
Engineering controls are physical changes that isolate people from a hazard without relying on behaviour. Example: fitting machine guarding, installing local exhaust ventilation for dust, or fitting permanent edge protection and guardrails around a flat roof. Engineering controls are effective because they work continuously, regardless of whether an individual remembers to follow a procedure.
4. Administrative controls
Administrative controls change how work is organised — through training, signage, permits-to-work, job rotation and safe systems of work. Example: a permit-to-work system for confined space entry, or job rotation to limit an individual's exposure to repetitive strain. These controls depend on people following procedures consistently, which makes them less reliable than physical measures.
5. Personal protective equipment (PPE)
PPE is the last resort in the hierarchy. It only protects the individual wearing it, only works when worn correctly, and only when it fits properly and is maintained. Under the Personal Protective Equipment at Work Regulations 1992, employers must provide suitable PPE free of charge — but only after they have shown that higher-order controls are not reasonably practicable on their own.
Worked example: a flat roof with permanent guardrails
A common question is what level of control a flat roof with permanent guardrails represents. Permanent guardrails are a physical, collective measure that prevents a fall from happening at all, without relying on any individual behaviour or equipment worn by a worker. This makes permanent guardrails an engineering control — level 3 in the hierarchy. They sit above administrative controls (such as a permit-to-work or training on safe roof access) and above PPE (such as a harness and lanyard used with fall-arrest equipment), because guardrails prevent the fall rather than merely arresting it or relying on a person to follow a procedure correctly. Under the Work at Height Regulations 2005, collective fall prevention measures like guardrails must always be considered before individual measures such as a harness.
Why the order matters legally
UK enforcement bodies expect employers to be able to show their reasoning for the control measures chosen. A risk assessment that jumps straight to PPE — issuing gloves or a harness without first considering whether the hazard could be eliminated, substituted, or controlled through engineering measures — is unlikely to meet the "suitable and sufficient" standard required under MHSWR 1999 Regulation 3(1). HSE inspectors routinely challenge assessments where PPE is used as the primary control when a higher-order measure was reasonably practicable. This is one of the most common reasons a risk assessment is judged inadequate during an inspection or after an incident.
The phrase "reasonably practicable" is central here. Employers are not required to eliminate every hazard regardless of cost or effort — the law requires a proportionate balance between the level of risk and the cost, time and effort of the control. But that balance must be demonstrated by working through the hierarchy in order, not by defaulting to the cheapest or easiest option.
Applying the hierarchy in a risk assessment
When completing a risk assessment, for each significant hazard identified you should record which level of the hierarchy has been applied and why higher-order controls were not used if a lower-order one was chosen instead. This reasoning is exactly what forms the "evaluate the risks and decide on precautions" step described in our ultimate guide to risk assessment. If you are unsure whether your activity legally requires a written risk assessment at all, see do I need a risk assessment.
Combining multiple levels of the hierarchy is normal and often necessary — a workplace might use engineering controls (guardrails), administrative controls (training and signage), and PPE (hard hats) together for the same hazard. What matters is that the higher-order controls have genuinely been considered and applied wherever reasonably practicable, rather than PPE being used as a substitute for them.
Also see: The ultimate guide to risk assessment · Do I need a risk assessment · Risk assessment legal requirements
Generate a risk assessment that applies the hierarchy correctly
Working through the hierarchy of controls for every hazard in a busy workplace can be time-consuming to write up properly. Anyrisks generates a fully written, regulation-referenced UK risk assessment that applies the hierarchy of controls in the correct order for your specific activity, delivered as a PDF and editable Word document in minutes.