What the hierarchy of risk controls actually is — and why it matters
The hierarchy of risk controls is a systematic approach to deciding how to manage a hazard. It is not a menu of options from which you can pick whichever seems most convenient. It is an ordered sequence, from most effective to least effective, and the law requires you to work down it in order. You cannot jump to the bottom of the hierarchy — PPE — without first considering everything above it.
The hierarchy has five levels. Level one is most effective: elimination removes the hazard entirely. Level five is least effective: PPE protects the individual worker but does nothing to address the hazard itself. The further down the hierarchy you go, the less effective the control — and the more residual risk remains.
The sequence is: eliminate, substitute, isolate, engineering controls, administrative controls, PPE. In some formulations, substitute comes before isolate. In construction, the order is commonly expressed as: eliminate, reduce, isolate, control, PPE — with reduce covering both substitution and engineering controls at the upper end of the hierarchy.
Why the hierarchy matters in construction RAMS
When a principal contractor or CDM client reviews your risk assessment, they are specifically looking to see whether you have applied the hierarchy correctly. They know that a risk assessment that lists only PPE controls — "wear gloves", "wear eye protection", "wear a hard hat" — has not properly considered the hazard. PPE is the last line of defence, not the primary control. If PPE is your only control, the risk assessment has failed.
The reason is straightforward: PPE fails. Gloves get cut. Eye protection gets knocked off. Ear defenders get removed for a quick task and not replaced. Hard hats get left in the van. Engineering controls and administrative controls do not have this failure mode — a locked-out switch stays locked out, a guard stays in place, a permit to work system continues to operate. Controls that eliminate or isolate the hazard are inherently more reliable than controls that rely on a worker remembering to use PPE correctly every time.
Level 1 — Elimination: removing the hazard entirely
Elimination is the most effective control in the hierarchy. If you can remove the hazard from the work process entirely, there is no risk to manage. The hazard cannot cause harm if it does not exist.
In construction, elimination is often possible at the planning stage — before work begins. Examples of elimination:
Work dead — eliminate the electrical hazard by ensuring no live conductors are present in the work area before electrical work begins. The hazard of electric shock is eliminated by the dead working procedure.
Off-site prefabrication — eliminate the work at height hazard by prefabricating roof structures on the ground and lifting them into position using a crane, rather than assembling trusses at height.
Use adhesive anchoring systems — eliminate the drill hammer hazard by using chemical anchors that do not require percussion drilling.
Use a concrete pump — eliminate the manual handling hazard of barrowing concrete by using a concrete pump to place it directly where needed.
Elimination is most powerful when it is designed into the work at the planning stage. Once a method has been chosen and the work is underway, elimination options become more limited — but they are still worth considering. If you are partway through a job and you identify a better way to eliminate a hazard, it is worth stopping and changing the method.
Level 2 — Substitution and engineering controls: reducing the hazard
Substitution replaces the hazard with something less dangerous. Engineering controls physically prevent the hazard from reaching workers. Both sit near the top of the hierarchy — more effective than administrative controls or PPE, but less reliable than elimination.
Substitution examples in construction:
Use a battery-powered tool instead of a petrol tool — eliminates the carbon monoxide hazard in enclosed spaces.
Use a lower-height access method — replace a 5-metre mobile tower with podium steps — reduces the consequences of a fall from height.
Use a pre-mixed mortar system instead of mixing cement on site — eliminates the silica dust hazard from cutting cement bags.
Use a lower-vibration tool — modern anti-vibration breakers vibrate significantly less than older models for equivalent work.
Engineering control examples:
Fixed guards on machinery — physically prevent access to moving parts while allowing the work to continue.
Local exhaust ventilation — removes hazardous dust and fumes at the point of generation before they can be inhaled.
RCD protection on electrical circuits — detects earth leakage and disconnects the supply in milliseconds, preventing electric shock.
Warning signs and physical barriers — prevent workers from entering hazardous areas without eliminating the underlying hazard.
Level 3 — Isolation: separating the hazard from the worker
Isolation separates the hazard from the worker by putting a barrier between them. The hazard still exists — but the worker cannot reach it. Isolation is more reliable than administrative controls or PPE because the barrier is physical and continuous — it does not depend on the worker applying it correctly every time.
Isolation examples in construction:
Lock-out tag-out (LOTO) — an isolating switch is locked in the off position and a danger tag is applied, preventing the equipment from being energised while work is in progress. The electrical hazard is isolated from the worker.
Safety netting below work at height — does not eliminate the fall hazard, but catches a falling worker before they hit the ground. The fall is isolated from the impact.
Cradles and gantries for work over water — physically prevents a worker from falling into the water.
Penetrating impermeable barriers — a physical barrier placed between a worker and a hazardous substance, such as lead paint or asbestos, preventing dermal contact or inhalation.
The reliability of isolation depends on the robustness of the barrier and the controls preventing the barrier from being bypassed. A safety net that is not securely anchored can fail. A lock-out that does not use a personal lock can be overridden by another person. Isolation controls must be designed to be tamper-resistant and must include measures to prevent accidental removal.
Level 4 — Administrative controls: changing how people work
Administrative controls change the way work is organised or performed to reduce exposure to the hazard. They do not physically change the hazard — they change the worker's interaction with it. They are less reliable than the three levels above because they depend on human behaviour — on workers following procedures correctly, consistently, and without constant supervision.
Administrative control examples in construction:
Permit to work systems — a formal system authorising specific work, specifying conditions, and defining a duration. Used for high-risk activities like hot works, excavation, and work at height.
Supervision — a competent supervisor present to monitor work and enforce controls. More important for less experienced workers.
Maximum exposure times — limiting how long a worker can be exposed to a hazard, such as vibration exposure limits or noise exposure limits.
Training and competence requirements — specifying that only trained and competent workers can perform specific tasks, reducing the likelihood of error.
Rotation — moving workers between tasks to limit cumulative exposure to hazards like vibration or noise.
Warning signs and instructions — signs that communicate the hazard and the required behaviour, such as 'hearing protection required beyond this point'.
Administrative controls are only effective when they are enforced. A permit to work system that is not monitored, a maximum exposure time that is not recorded, and supervision that is not actually present — these are not controls. They are pieces of paper. The hierarchy requires you to actually implement and maintain the controls, not just write them.
Level 5 — PPE: the last line of defence
Personal Protective Equipment is the last line of defence. When all other controls have been applied, and a residual risk remains, PPE protects the individual worker from the hazard that cannot be eliminated, reduced, isolated, or controlled by other means.
The PPE hierarchy in construction, from most to least commonly used:
Head protection — safety helmet to protect against falling objects and impact with fixed structures.
Eye protection — safety spectacles or goggles to protect against flying particles, chemical splash, and optical radiation.
Hearing protection — ear defenders or ear plugs to protect against noise above 85dB.
Hand protection — safety gloves specific to the hazard — chemical-resistant gloves, cut-resistant gloves, thermal gloves.
Respiratory protection — FFP3 dust masks or half-mask respirators for hazardous dusts, fumes, and vapours.
High-visibility clothing — to ensure workers are visible to vehicle drivers and plant operators.
Safety footwear — steel toe cap boots, penetration-resistant soles, anti-slip soles.
Fall arrest equipment — full body harness, shock-absorbing lanyard, anchor points for work at height where other controls are insufficient.
PPE must be appropriate to the hazard, correctly specified with the right EN standard, maintained in good condition, and used consistently by every worker who is exposed to the hazard. A worker who removes their gloves for a five-minute task has not controlled the hazard — they have chosen to accept the risk for that five minutes.
How to document the hierarchy in your RAMS
For each hazard in your risk assessment, document your application of the hierarchy in order. Show your reasoning at each level — why elimination was not possible, why substitution was not practical, why you arrived at the level you did. This demonstrates active risk management, not just a list of controls.
The format for each hazard in the RAMS should be:
Hazard description — what can cause harm.
Initial risk rating — Likelihood × Severity before any controls (to establish the starting point).
Hierarchy application — for each level of the hierarchy, state whether it is applicable, and if so, what specific control was applied. If not applicable, state why.
Residual risk rating — Likelihood × Severity after all controls applied.
Control verification — how you will confirm the controls remain effective throughout the work.
This structure shows a principal contractor that you have genuinely worked through the hierarchy — not just listed PPE and moved on. It is the difference between a RAMS that passes review and one that gets sent back.
Common hierarchy mistakes in construction RAMS
The most common mistake is leading with PPE. A risk assessment that begins with "wear gloves, wear eye protection, wear a hard hat" before even considering elimination or substitution has not applied the hierarchy. A principal contractor reading this will know immediately that the risk assessment is not site-specific and does not reflect genuine hazard management.
The second most common mistake is not explaining why upper-level controls are not applicable. If elimination is not possible, say why — the work cannot be done without live conductors because testing requires live conditions. If substitution is not possible, explain why — no lower-vibration tool exists that can do this specific work. Leaving these gaps makes it look like you haven't considered them.
The third mistake is treating the hierarchy as optional — applying it for some hazards and not for others. The hierarchy applies to every hazard. The level you arrive at for each hazard will differ — elimination is possible for some hazards and not for others — but the process of working through the hierarchy must be consistent.
Use the hierarchy to build clearer RAMS controls
RAMS Builder can help you structure controls around the hierarchy by prompting you to work through elimination, substitution, isolation, engineering controls, administrative controls, and PPE in order. Use it as a drafting aid, then review each hazard so the final RAMS reflects the actual controls, reasoning, and site conditions for the job.
How the hierarchy applies to specific construction hazards
The hierarchy of risk controls is not applied the same way for every hazard — the specific controls at each level differ depending on the nature of the hazard. Understanding how the hierarchy applies to specific hazards is essential for writing RAMS that demonstrate genuine hazard management.
For dust and hazardous substances (COSHH hazards)
At the eliminate level: can a less hazardous substance be used? For example, using a pre-mixed mortar instead of mixing cement on site eliminates the silica dust hazard from bag handling and mixing. Using a water-based paint instead of a solvent-based paint eliminates the solvent vapour hazard. These substitutions eliminate the exposure entirely.
At the reduce level: can the process be changed to reduce exposure? For example, using a slow-speed mixer to reduce the aerosolisation of cement dust, or using a longer nozzle on a cartridge gun to keep the operator further from the fumes. These reduce exposure without eliminating it.
At the isolate level: can the hazard be contained? For example, enclosing the mixing process within a sealed cabinet with extraction, or using a local exhaust ventilation system that captures fumes at the source before they can be inhaled.
At the administrative level: can the number of workers exposed be limited? For example, restricting access to an area where dusty work is taking place, scheduling high-exposure tasks at the start of the shift before other trades arrive, or rotating workers to limit individual exposure time.
At the PPE level: FFP3 respiratory protection is the last resort when all other controls have been assessed and found insufficient. PPE for hazardous substances must be appropriate to the specific hazard — particle filters for dusts, gas and vapour filters for fumes and vapours.
For work at height
At the eliminate level: can the work be done from ground level? Can components be pre-assembled at ground level and lifted into position? Can the work be redesigned to eliminate the height element entirely? Elimination of the fall hazard is possible in many construction scenarios through prefabrication and pre-assembly.
At the reduce level: can the consequences of a fall be reduced? For example, using a safety net to reduce the distance of a fall rather than preventing the fall entirely. Or reducing the height from which work takes place — using podium steps instead of a higher access method.
At the isolate level: can a physical barrier prevent a person from reaching the edge? Guard rails and toe boards installed at the edge of a platform physically prevent a person from falling, even if they lose their footing.
At the administrative level: can procedures reduce the likelihood of a fall? For example, a permit to work system that requires specific checks before work at height commences, supervision requirements for work at height, and restrictions on work at height in adverse weather conditions.
At the PPE level: a full body harness with a shock-absorbing lanyard and suitable anchor point is the last resort when collective protection is not reasonably practicable.
The hierarchy in CDM 2015 and principal contractor RAMS review
Under CDM 2015, principal contractors reviewing sub-contractor RAMS are specifically looking for evidence that the hierarchy of controls has been applied. A RAMS that lists only PPE controls — or that lists PPE first — signals to the principal contractor that the hazard management has not been properly planned.
The principal contractor's review of RAMS should check: has elimination been considered for each hazard? Has the reasoning been documented for each level of the hierarchy — either stating what control was applied or explaining why that level was not applicable? Does the residual risk after all controls justify proceeding with the work? Are the controls specific and verifiable, or are they vague statements that could not be checked on site?
A RAMS that demonstrates genuine application of the hierarchy — with specific controls at each level and documented reasoning — is a RAMS that will pass principal contractor review. It signals that the person who wrote the RAMS understands hazard management and has planned the work properly.