The hierarchy of control is a structured, risk-based framework for managing workplace risk under New Zealand’s Health and Safety at Work Act 2015 (HSWA). It guides PCBUs to prioritise controls that eliminate or minimise risk, rather than relying on administrative controls or personal protective equipment alone.
Importantly, the hierarchy of control under HSWA 2015 is not the same as the inverted pyramid commonly shown online. That older model relates to the repealed Health and Safety in Employment Act 1992 and focuses on hazards, not risk. HSWA 2015 requires a risk management approach, and the hierarchy must be applied accordingly.
The hierarchy of control under HSWA 2015 is a risk-based framework that prioritises elimination first, then substitution, isolation or engineering controls, followed by administrative controls, with PPE used only as a last line of defence.
Hierarchy of Control and Managing Workplace Risk Under HSWA 2015
Under Regulation 6 of the Health and Safety at Work (General Risk and Workplace Management) Regulations 2016, PCBUs must eliminate risks so far as is reasonably practicable. If elimination is not reasonably practicable, risks must be minimised using one or more of the following controls:
Substitution
Isolation
Engineering controls
Crucially, these three sit at the same level. One is not automatically better than the other. The correct control depends on the nature of the risk and the work being undertaken.
Only where risk remains should administrative controls be applied, and PPE used as the final layer.
Elimination in the Hierarchy of Control – Removing Risk at Source
Elimination is the most effective way to manage workplace risk. If the risk is removed entirely, there is nothing left to manage.
Examples of elimination in practice include:
Designing out hazardous tasks during project planning
Removing hazardous substances from a process entirely
Eliminating the need to work at height through equipment redesign
Under HSWA 2015, elimination must always be considered first, even if it is ultimately deemed not reasonably practicable.
Though not always possible, this approach should be the first consideration during any risk assessment.
Substitution in the Hierarchy of Control for Managing Risk
Substitution involves replacing a risk with a lower-risk alternative. Under HSWA 2015, substitution is one of the primary methods for minimising risk when elimination is not achievable.
Examples include:
Substituting solvent-based products with water-based alternatives
Replacing manual handling with mechanical aids
Using quieter equipment to reduce noise exposure
Substitution does not remove risk entirely, but it can significantly reduce both likelihood and consequence.
Isolation in the Hierarchy of Control – Separating People From Risk
Isolation controls risk by separating workers from the source of harm. Under the current legislation, isolation is not subordinate to engineering controls – it is an equally valid risk minimisation option.
Examples include:
Physical barriers or exclusion zones
Remote operation of plant or equipment
Traffic separation between vehicles and pedestrians
Isolation is particularly effective where risk cannot be eliminated or substituted but can be physically contained.
Engineering Controls in the Hierarchy of Control Framework
Engineering controls reduce risk through physical design or modification. They work by reducing exposure rather than relying on human behaviour.
Common engineering controls include:
Machine guarding
Local exhaust ventilation
Automated shutdown systems
Noise enclosures
Engineering controls are often more reliable over time because they do not depend on individual compliance.
Administrative Controls in the Hierarchy Of Control
Administrative controls change the way work is performed. Under HSWA 2015, they must only be relied on after higher-order controls have been considered.
Examples include:
Safe work procedures
Training and competency systems
Permits to work
Rostering to manage fatigue
Administrative controls are important but fragile. They require ongoing supervision, reinforcement, and review to remain effective.
PPE in the Hierarchy of Control – The Last Line of Defence
Personal Protective Equipment (PPE) sits at the bottom of the hierarchy of control and should never be the primary risk control.
Limitations of PPE include:
It does not eliminate risk
It relies on correct selection, fit, and use
It can fail through wear, misuse, or fatigue
PPE should be used to supplement, not replace, higher-order controls.
How to Apply the Hierarchy Of Control in the Workplace
To correctly apply the hierarchy of control under HSWA 2015:
Identify the risk, not just the hazard
Attempt elimination first and document why it is or is not reasonably practicable
Select substitution, isolation and engineering controls as appropriate
Layer administrative controls where residual risk remains
Use PPE only as a final defence
This approach aligns with WorkSafe guidance and legislative expectations.
Then monitor and review.
Are the controls working? What’s changing in your environment? Safety isn’t “set and forget.” Regular reviews are critical.
The Hierarchy Of Control and Legal Compliance
New Zealand's HSWA 2015 requires a proactive approach to risk management. Following the hierarchy of control supports your PCBU (Person Conducting a Business or Undertaking) duties under the Act, particularly:
Section 30: Managing risks
Section 36: Primary duty of care
Section 45: Worker responsibilities
Regulations 6–9: Risk management requirements
PCBUs must eliminate risks so far as is reasonably practicable and, where elimination is not possible, apply the hierarchy of controls in order, documenting why higher-order controls cannot reasonably be used and ensuring controls are maintained and reviewed.
Failing to consider higher-level controls before defaulting to PPE can lead to enforcement actions by WorkSafe NZ.
Common Mistakes When Using the Hierarchy of Control
Mistake 1 – Using the Old Hazard Pyramid
Many organisations still reference the pre-2015 inverted hierarchy. This does not meet HSWA expectations and can undermine risk assessments.
Mistake 2 – Treating Substitution, Isolation and Engineering as Ranked
Under HSWA 2015, these controls are equal options, not a strict ranking.
Mistake 3 – Jumping Straight to PPE
PPE without higher-order controls is a red flag during audits, investigations, and prosecutions.
Hierarchy of Control in Construction, Manufacturing and Infrastructure
Construction example – Working at height
Elimination – Design to avoid height work
Substitution – Use prefabrication at ground level
Isolation – Guardrails and edge protection
Engineering – Scaffolding systems
Administrative – Permits and supervision
PPE – Harnesses
Manufacturing example – Chemical exposure
Elimination – Remove hazardous chemical
Substitution – Lower-toxicity product
Engineering – Ventilation systems
Isolation – Enclosed processes
Administrative – Exposure limits and training
PPE – Gloves and respirators
Final Thoughts on the Hierarchy of Control and Managing Workplace Risk
The hierarchy of control is not a diagram to tick off – it is a thinking framework for managing risk under HSWA 2015. When applied correctly, it drives better decisions, stronger systems, and defensible compliance.
If your risk documentation still references the old hazard-based hierarchy, now is the time to update it.
At Advanced Safety, we help businesses translate legislative intent into practical, audit-ready systems that actually work in the real world.
Want help applying the hierarchy of control correctly?
Our Compliance Compass and Safety Shield programmes ensure your risk management approach aligns with HSWA 2015 – not outdated models.
