When an organization has identified hazards and established the risks those hazards pose, it must have a process(es) in place to ELIMINATE hazards, or where this is not possible, to reduce the risks associated with the identified hazard(s), using the hierarchy of controls.
At the top of the hierarchy of controls is ELIMINATION. This is the most effective way of managing risks associated with identified hazards. The lowest level of the hierarchy of controls is the use of PPE, which should only be used if other controls are not possible. In many cases, a combination of controls is needed to address the risks if the hazard cannot be eliminated.
The basic principle of implementing the hierarchy of controls looks like this:
First, ELIMINATE a hazard by changing the process, materials, products, etc.
If that is not possible, SUBSTITUTE what is causing the hazard with something less hazardous.
Further actions can include applying ADMINISTRATIVE CONTROLS (e.g., instructions, organizing work schedules to reduce exposure time, etc.) and training to make workers more competent and aware of hazards and risks.
Finally, PPE can minimize worker exposure to remaining risks if the previous steps are ineffective in keeping workers safe and healthy.
In applying the hierarchy, consideration should be given to risk reduction benefits and reliability of the available options. With risk being a combination of likelihood and severity, any action to reduce risk should reduce the likelihood or the severity, or both.
An organization should take into account:
- The need for a combination of controls, combining elements from the hierarchy (e.g,. engineering and administrative controls);
- established good practices in the control of the particular hazard;
- adapting work to the individual (e.g., to take account of individual mental and physical capabilities);
- taking advantage of technical progress to improve controls;
- using measures that protect everyone (e.g., by selecting engineering controls that protect everyone in the vicinity of a hazard in preference to PPE);
- human behavior and whether a particular control measure will be accepted and can be effectively implemented;
- human factors (e.g., simple failure of a frequently repeated action, lapses of memory or attention, lack of understanding or error of judgment, breach of rules or procedures) and how to take these into account when reducing risks, if possible, by eliminating or minimizing reliance on human
reaction or decision-making for safe operation; - the need to introduce planned maintenance of, for example, machinery safeguards;
- the possible need for emergency/contingency arrangements where risk controls fail;
- potential lack of familiarity with the workplace and existing controls for workers and other relevant interested parties not in the direct employment of the organization (e.g., visitors, contractors);
- existing good practices applied in companies with similar situations (examples of good practice can be found in, for example, national institutes, international organizations, sectoral organizations).
Once the controls have been determined, the organization should prioritize its actions to implement them. The organization should prioritize actions that address a HIGH-RISK activity or offer a substantial reduction of risk rather than those with limited risk reduction benefits. In prioritizing actions, an organization should take into account:
- the potential impact on the risk through the planned controls;
- the severity of the consequences of the risk;
- the magnitude of the risk (combination of likelihood and severity of the risk);
- the number of workers who will benefit from the reduction of risk;
- the complexity and feasibility of the measures that need to be put in practice.
Sometimes, it is necessary to modify work activities until risk controls are in place or apply temporary risk controls until more effective actions are completed. For example, using hearing protection as an interim measure until the noise source can be eliminated or segregate the work activity to reduce
the noise exposure. Temporary controls should not be considered a long-term substitute for more effective risk control measures.
Sometimes the term “residual risk” describes the risk that remains after controls have been implemented. The organization should conduct ongoing monitoring to ensure that the adequacy of the controls is being maintained.
Source: ISO 45001:2018
