The Hierarchy of Controls Explained: A Practical Guide for Australian Workplaces

The hierarchy of controls is the cornerstone of risk management under Australian WHS legislation. It's referenced in the model WHS Act (Section 17), every model Code of Practice, and underpins every SWMS, JHA, and risk assessment. Yet many workplaces still default to PPE as the primary control measure.

The six levels

The hierarchy ranks control measures from most effective (elimination) to least effective (PPE). Higher-level controls are preferred because they don't rely on human behaviour.

1. Elimination — Remove the hazard entirely

The most effective control. Examples:

2. Substitution — Replace the hazard with something less dangerous

3. Isolation — Separate people from the hazard

4. Engineering controls — Design out the risk

5. Administrative controls — Change the way people work

6. PPE — Personal Protective Equipment

The last line of defence:

PPE must comply with relevant Australian Standards (AS/NZS 1800 series for selection, care, and use).

Common mistakes in applying the hierarchy

Jumping straight to PPE. Regulators specifically look for evidence that higher-level controls were considered and documented before defaulting to PPE. Your risk assessment must show the decision-making process.

Applying one level in isolation. Effective risk management almost always uses multiple levels simultaneously. A scaffolding job might eliminate some tasks by prefabricating at ground level (elimination), use guardrails (engineering), implement a permit-to-work system (administrative), and require harnesses when working outside guardrailed areas (PPE).

Not reviewing controls. Control measures must be reviewed when circumstances change, a new hazard is identified, consultation finds they're not effective, or a health monitoring result suggests a problem (Regulation 38).

Documentation requirements

Under the model WHS Regulations, the risk management process — including how you applied the hierarchy of controls — must be documented for:

Even where documentation isn't legally mandated, it's best practice. In the event of an incident, regulators will ask to see your risk assessment and the reasoning behind your control measures.

AI and the hierarchy of controls

AI compliance tools can analyse a task description and automatically recommend controls at each level of the hierarchy, drawing from current regulations and Safe Work Australia guidance. This ensures the consideration of higher-level controls is documented and defensible — even when time pressure tempts teams to jump straight to PPE.