Hierarchy of Controls Application

Why the Hierarchy of Controls Matters

The hierarchy of controls is arguably the single most important framework in occupational safety and health practice, and it appears throughout the BCSP Certified Safety Professional (CSP) examination blueprint, especially within the Risk Management domain. Every safety professional is ultimately judged on one question: did you reduce risk in the most effective way reasonably available? The hierarchy answers that question by ranking control strategies from most to least effective and reliable. Regulators (OSHA, MSHA), consensus standards (ANSI/ASSP Z10, ANSI/ASSP Z590.3, ISO 45001), and NIOSH all embed the hierarchy into their expectations. On the exam, you will not simply be asked to list the hierarchy; you will be asked to apply it to scenarios, choose the best control among plausible options, recognize when a lower-tier control is being used inappropriately, and understand how the hierarchy interacts with risk assessment, residual risk, and ALARP (As Low As Reasonably Practicable) decision-making.

What the Hierarchy of Controls Is

The hierarchy of controls is a prioritized ranking of methods for reducing or eliminating hazards and the risks they create. The most widely tested version (NIOSH / ANSI Z10) has five tiers, listed from most effective to least effective:

1. Elimination – Physically remove the hazard. Examples: redesigning a process so a toxic chemical is no longer used; eliminating work at height by assembling components at ground level; removing a trip hazard entirely.
2. Substitution – Replace the hazard with something less hazardous. Examples: replacing a solvent-based coating with a water-based one; using a lower-voltage tool; replacing a manual lift with a lighter load configuration.
3. Engineering Controls – Isolate people from the hazard through physical means that do not depend on worker behavior. Examples: machine guards, local exhaust ventilation, interlocks, enclosures, sound-dampening barriers, guardrails, lift-assist devices.
4. Administrative Controls – Change the way people work. Examples: written procedures, training, job rotation, warning signs, exposure time limits, permit systems, housekeeping schedules, supervision.
5. Personal Protective Equipment (PPE) – Protect the worker with equipment worn on the body. Examples: respirators, hearing protection, gloves, safety glasses, fall arrest harnesses.

Some frameworks (such as ANSI/ASSP Z590.3 Prevention through Design) present six levels by splitting out warnings as a separate step between engineering and administrative controls. The CSP exam is generally consistent with the five-tier model, but you should recognize the six-tier variant if a question references Z590.3 or describes warnings and signage as a discrete category.

The Core Principle: Reliability Decreases as You Move Down

The hierarchy is ordered by effectiveness, and effectiveness is tightly linked to reliability and independence from human behavior. Elimination and substitution address the hazard itself, so the risk does not exist (or is dramatically smaller) regardless of what workers do. Engineering controls leave the hazard present but create a physical barrier that works passively. Administrative controls and PPE leave the hazard fully present and rely on consistent human behavior: a worker must remember the procedure, follow the sign, wear the respirator correctly, and the respirator must fit, be maintained, and be appropriate for the contaminant. Human reliability is variable, which is why the lower tiers are considered weaker and are expected to be used as supplements to higher-tier controls, not as replacements for them.

A related concept is protection factor and failure mode. Higher-tier controls tend to fail safe or fail obviously (a missing guard is visible); lower-tier controls tend to fail silently (a respirator cartridge that is saturated looks identical to a fresh one). This is why the exam heavily favors engineering solutions over PPE when both are presented as options.

How the Hierarchy Is Applied in Practice

Applying the hierarchy is a structured process, not a one-time choice. The CSP exam expects you to understand the following sequence:

Step 1 – Identify hazards and assess risk. Use hazard analysis tools such as Job Hazard Analysis (JHA), Preliminary Hazard Analysis (PHA), What-If, HAZOP, or FMEA to identify hazards and estimate risk using a risk matrix (severity x likelihood). You cannot select a control without knowing the initial risk level.

Step 2 – Start at the top of the hierarchy. Ask first whether the hazard can be eliminated. If not, can it be substituted? Only after exhausting higher tiers should you move downward. The exam tests this discipline constantly; the wrong answer is often a quick jump to training or PPE.

Step 3 – Evaluate feasibility. Feasibility has two dimensions: technical feasibility (can it physically be done?) and economic feasibility (is the cost reasonable relative to the risk reduction achieved?). OSHA uses feasibility language in its standards, such as requiring feasible engineering and administrative controls before relying on respirators in the Respiratory Protection Standard (1910.134) and in the air contaminants standards. ALARP reasoning says that risk should be reduced until the cost of further reduction is grossly disproportionate to the benefit.

Step 4 – Layer controls (defense in depth). In most real situations no single control is sufficient. A noise hazard might be addressed with an engineered enclosure (engineering), a rotation schedule to limit exposure time (administrative), and hearing protection as a supplement (PPE). The exam favors answers that combine higher-tier controls with supporting lower-tier controls rather than relying on a single lower-tier control.

Step 5 – Assess residual risk. After controls are selected, re-evaluate the risk. Residual risk is the risk remaining after controls are applied. If residual risk is still unacceptable, return to the hierarchy and add or upgrade controls. If acceptable, document the decision and the rationale.

Step 6 – Verify, monitor, and review. Controls degrade. Guards get removed, ventilation systems lose airflow, procedures drift. Implement verification (inspections, exposure monitoring, audits) and review controls after incidents, process changes, or new information. This ties the hierarchy to Management of Change (MOC) and continual improvement in Z10 and ISO 45001.

Prevention through Design (PtD)

The highest-value application of the hierarchy occurs during design, before a facility, process, or product exists. ANSI/ASSP Z590.3 formalizes this as Prevention through Design. The cost of control is lowest and the effectiveness is highest at the concept and design phases, because elimination and substitution are realistic options. Once a facility is built, the practical options often shrink to engineering retrofits, procedures, and PPE. The exam may ask when in a project life cycle the hierarchy is most effectively applied; the answer is early, during design and planning.

Common Misapplications the Exam Tests

- Treating PPE as a primary control. PPE is the last line of defense and should be used when higher controls are infeasible, during the interim while higher controls are being installed, or as a supplement to them.
- Confusing substitution with elimination. If the hazard is still present in a lesser form, it is substitution. If it is gone entirely, it is elimination.
- Confusing engineering and administrative controls. The test is whether the control is a physical change that works without relying on worker behavior (engineering) or a change to how people work (administrative). A sign is administrative. A guard is engineering. A procedure is administrative. An interlock is engineering.
- Mistaking training for risk reduction. Training is necessary and legally required, but it does not change the hazard. On exam questions, training is rarely the best answer when a physical control is available.
- Ignoring new hazards created by a control. Substituting a less flammable solvent that is more toxic, or adding a guard that creates an ergonomic reach problem, means the control must be re-assessed. Always consider hazard transfer and unintended consequences.
- Regressive substitution. Replacing one hazard with another of equal or greater risk is not a valid application of the hierarchy.

Worked Example

A facility has workers manually spraying a solvent-based paint in an open area, with measured exposures above the PEL. Options presented might be: (A) provide half-mask respirators and a written respiratory protection program; (B) rotate workers to limit each individual's exposure to two hours; (C) install a spray booth with local exhaust ventilation; (D) switch to a water-based coating that meets product specifications.

The best answer is (D), substitution, because it addresses the hazard itself. If the water-based coating does not meet specifications (technically infeasible), the next best is (C), an engineering control. Options (A) and (B) are legitimate supplemental controls but should not be chosen as the primary solution when (C) or (D) are feasible. Note also that OSHA requires feasible engineering and administrative controls to be implemented before respirators are used as the primary means of compliance.

Exam Tips: Answering Questions on Hierarchy of Controls Application

1. Always ask: which option is highest on the hierarchy AND feasible? If a question gives you an elimination or substitution option that is described as technically and economically feasible, it is almost always the correct answer, even if the engineering option sounds sophisticated.

2. Watch for feasibility qualifiers in the stem. Words like cannot be eliminated, no acceptable substitute exists, or process cannot be changed are signals that the question wants you to move down to the next tier. Do not pick an option the stem has already ruled out.

3. Read for the word best, most effective, first, or preferred. These require you to rank. The word first in a question about control selection means elimination; last means PPE.

4. Distinguish between what is required and what is best. A question may ask what a regulation requires (for example, feasible engineering and administrative controls before respirators) versus what is the most effective control in a scenario. Answer the question actually asked.

5. Classify each answer option before choosing. Mentally label each option as E, S, Eng, Admin, or PPE. This prevents being fooled by attractive wording. A detailed, well-written training program is still administrative.

6. Be alert to interim controls. If a question asks what should be done immediately or until the engineering control is installed, administrative controls and PPE become correct answers because they are the only options deployable quickly. The hierarchy governs long-term strategy; interim protection may legitimately come from lower tiers.

7. Recognize layered answers. If one option combines an engineering control with supporting administrative controls and PPE, and another offers only PPE, the layered option is typically correct because it reflects defense in depth.

8. Check for hazard transfer. An option that reduces one hazard but introduces a greater or equal new hazard is a distractor. The exam likes to present a substitution that is less flammable but more toxic, or an enclosure that creates a confined space.

9. Connect to residual risk. Questions may describe a control already in place and ask what to do next when risk is still unacceptable. The answer is to return to the hierarchy and add a higher-tier control, not to add more of the same lower-tier control.

10. Know the life-cycle timing. If asked when controls are most cost-effective or when the hierarchy is best applied, the answer is during design and planning (Prevention through Design), not after an incident or after installation.

11. Know the standards that codify the hierarchy. Be able to associate the hierarchy with ANSI/ASSP Z10 (occupational health and safety management systems), ANSI/ASSP Z590.3 (Prevention through Design), ISO 45001 (clause on hazard identification and risk control), NIOSH, and OSHA's feasibility requirements in exposure standards.

12. Eliminate distractors systematically. Cross out options that (a) rely solely on worker behavior when a physical control is available, (b) are infeasible per the stem, (c) create a new hazard, or (d) address a different hazard than the one described. What remains is usually the correct choice.

13. Do not overthink cost. The exam generally assumes that a feasible higher-tier control is worth implementing. Only treat cost as disqualifying when the stem explicitly describes it as grossly disproportionate or infeasible.

14. Remember the purpose of the hierarchy. It exists because people are unreliable and hazards are persistent. When in doubt, choose the answer that reduces dependence on human behavior.

Quick Reference Summary

- Order: Elimination > Substitution > Engineering > Administrative > PPE.
- Higher tiers act on the hazard; lower tiers act on the worker.
- Feasibility (technical and economic) determines how far down you must go.
- Layer controls; assess residual risk; verify and review.
- Apply earliest in the life cycle for maximum effect (Prevention through Design).
- PPE and administrative controls are supplements or interim measures, not the primary strategy when higher-tier controls are feasible.

Mastering the hierarchy of controls is less about memorizing five words and more about developing a disciplined habit of thought: identify the hazard, start at the top, prove each tier infeasible before descending, layer what remains, and verify the result. If you bring that habit to every scenario question on the CSP exam, you will consistently identify the answer the examiners intend.