5.1 The Hierarchy of Controls: Engineering, Administrative, and PPE Selection Criteria

The Hierarchy of Controls

The NIOSH hierarchy orders control approaches as elimination, substitution, engineering controls, administrative controls and personal protective equipment. Start with ways to remove or reduce the hazard, then select the combination needed for the remaining risk. The hierarchy supports a decision; it does not remove the need to assess feasibility, maintenance and actual performance.

Distinguish the five approaches

Elimination removes the hazard or the hazardous task. Designing a component so that no elevated installation is required can remove that particular work-at-height exposure. Moving elevated work to a different worker is not elimination.

Substitution replaces a hazardous material, process or tool with a less hazardous alternative for the intended use. Compare all relevant hazards. A less flammable solvent may introduce toxicity or environmental problems. Confirm that the alternative actually performs the required task before accepting the change.

Engineering controls separate people from the hazard or reduce it at the source. Examples include properly designed local exhaust ventilation, enclosures, interlocked guards and noise isolation. An enclosure can fail, a filter can load, and a guard can be bypassed. Commission the system and specify inspections, maintenance and response to a loss of control.

Administrative controls change how work is organized: access restrictions, procedures, scheduling, training and supervision. They can be essential, but depend on implementation. Rotating work may reduce an individual's dose while exposing more people; check the particular substance rule and all exposure pathways rather than assuming rotation is always permitted or always prohibited.

PPE provides protection worn by the worker. Select it for the hazard, exposure and task, and ensure correct use, fit, compatibility and maintenance. It may be needed during installation of other controls, emergencies, work with infeasible controls or residual exposures. Its presence does not automatically prove the underlying exposure problem is adequately controlled.

Use inherently safer design questions

The common process-safety prompts are to minimize, substitute, moderate and simplify. Minimize the hazardous inventory; substitute a less hazardous material or process; moderate the conditions or physical form; simplify the system so dangerous errors are less likely. These are questions to investigate, not guarantees of safety.

For example, replacing a fine combustible powder with a suitable slurry may reduce airborne dust and inhalation exposure. The slurry carrier can introduce flammability, reactivity or handling hazards, so review the new process as a whole. Reducing inventory changes the potential release quantity; it does not necessarily change the material's toxicity. A keyed connection can reduce misconnection risk but still needs inspection and a compatible maintenance system.

Check for secondary hazards and residual risk

A nitrogen-blanketing system may reduce combustion potential inside a vessel while creating an oxygen-displacement hazard where nitrogen can accumulate. Evaluate leak and vent locations, ventilation, access, monitoring and emergency response. Nitrogen provides no odor warning. Do not assume that every low-oxygen atmosphere is safe merely because it cannot support the original fire scenario.

Apply management of change before implementation. Ask what happens during normal operation, startup, shutdown, maintenance, a power loss and foreseeable misuse. Determine how failure will be detected and how workers will be protected while repairs are made. Record any remaining risk and who is authorized to accept it under the organization's process.

Verify effectiveness with appropriate evidence. For ventilation, measure performance and exposure under representative operating conditions. For guarding, check access, stopping behavior and intended servicing. For a scheduling control, verify actual exposure time rather than the planned roster. Worker feedback can identify inconvenient or unreliable controls before bypassing becomes routine.

Compare life-cycle costs transparently

Cost evaluation should use project-specific information. Include design, installation, downtime, energy, maintenance, consumables, training and required exposure or health assessments. Avoid assuming that engineering controls eliminate every recurring cost or that respiratory protection always has a particular failure percentage.

Consider this illustrative, undiscounted ten-year comparison, assuming both proposals have been separately assessed for adequate protection:

The first total is $120,000 + 10 × $8,000; the second is $10,000 + 10 × $28,000. The difference is $90,000 over the stated period. The additional initial investment is $110,000 and the annual saving is $20,000, giving a simple payback of 5.5 years. This example excludes discounting, salvage value, taxes and uncertain losses; a real proposal should include relevant effects and sensitivity analysis. It does not establish a universal three-to-five-year engineering payback.

Do not choose an inadequate control because it has the lowest calculated cost. Avoid counting the same expected loss both as an insurance expense and again as a separate avoided claim. State which benefits are measured, estimated or qualitative.

Apply respiratory requirements accurately

Under OSHA 1910.134, engineering controls are the primary means of preventing atmospheric contamination where feasible. Appropriate respirators are used where effective engineering controls are not feasible or while they are being instituted, and where otherwise required.

A required-use program includes selection, medical evaluation, appropriate fit testing, training, maintenance and program evaluation. Medical evaluation must occur before fit testing or required use; additional evaluations follow the triggers in paragraph (e)(7). The standard does not impose universal annual medical examinations or spirometry. Tight-fitting facepiece fit testing is required before initial use, at least annually, and when specified changes require another test. Training and medical surveillance required by a substance-specific rule must be evaluated separately.

Lead exposure: read the actual control rule

The federal general-industry lead standard, 1910.1025, sets an eight-hour permissible exposure limit of 50 micrograms per cubic metre. Its feasible engineering and work-practice control requirements cannot be waived merely because capital funding has not been approved.

The standard does not categorically prohibit rotation. Under paragraph (e)(5), when administrative controls reduce employees' time-weighted-average exposure, the employer must establish a job-rotation schedule that records affected workers, location and duration, exposure information and any other information useful in assessing reliability. A proposed rotation is therefore a plan to evaluate and document, not automatic proof of compliance.

For an illustrative eight-hour shift with two hours at 120 micrograms per cubic metre and six hours at zero, the average is (2 × 120 + 6 × 0) ÷ 8 = 30 micrograms per cubic metre. Verify that the assumed zero exposure is real, consider all tasks and workers, and address the standard's other duties. Arithmetic below the PEL does not by itself establish an adequate lead program. For powered and non-powered air-purifying respirators used under the standard, paragraph (f)(3) requires HEPA filters; selection must also meet the necessary protection level.

The management decision combines the legal control requirements, representative exposure evidence, feasible engineering measures, worker participation and a plan to verify performance after implementation.