The hierarchy of controls is the ranked sequence for controlling occupational health and safety risks. ISO 45001 clause 8.1.2 requires organisations to apply it, in order.
The order
- Eliminate the hazard
- Substitute with something less hazardous
- Engineering controls and reorganisation of work
- Administrative controls, including training
- Personal protective equipment
Why the order is mandatory rather than advisory
Controls at the top remove the hazard for everyone, permanently, without depending on human behaviour. Controls at the bottom depend on a person doing the right thing every time, and fail whenever anyone is tired, rushed or untrained.
PPE is the last resort precisely because it protects one person, only while worn correctly, and does nothing about the hazard itself.
The finding auditors look for
Risk assessments that jump straight to PPE and training. The requirement is not simply to have controls — it is to demonstrate that higher-order options were considered first. If elimination and substitution were rejected, the reasoning should be visible.
This is a common weakness in otherwise solid safety systems, and it is a fair one: eliminating a hazard usually costs capital, while issuing gloves does not.
Worker participation
ISO 45001 places unusually strong emphasis on consultation and participation of workers, including non-managerial workers, in hazard identification and control selection. It is one of the clearest differences between ISO 45001 and the other management system standards, and one of the most commonly under-implemented.