EPHM7320 Chap.3 Risk Assessment and the Control Hierarchy
Risk Assessment and the Control Hierarchy
Assessment must lead to an owned action
The five-step sequence identifies hazards, people and routes of harm, evaluates risk, records findings and controls, then reviews the assessment. The control hierarchy prefers elimination, substitution and engineering before administrative measures and personal protective equipment.
This chapter explains how to choose the highest practicable control, layer measures for residual risk and specify ownership, completion evidence, effectiveness measures and review triggers. A recorded rating is not the endpoint. The reasoning should expose assumptions, distinguish existing from proposed controls and reopen when tasks, people, equipment or knowledge change.
Implementation evidence must show that the chosen measure reached real work, while effectiveness evidence tests whether the exposure pathway and residual risk changed as intended.
What this chapter covers
- 01
The five assessment steps
- 02
Likelihood and consequence reasoning
- 03
Elimination and substitution
- 04
Engineering and administrative controls
- 05
Personal protective equipment
- 06
Ownership and review triggers
Worked example · free
Control dust during short cutting work
- 3Define source, route and exposed groups.
- 4Work down the hierarchy in order.
- 3State verification and review evidence.
Key terms
- Risk Assessment
- A structured process for identifying hazards, judging risk, selecting controls, recording findings and reviewing change.
- Elimination
- Complete removal of the hazardous source or the need for exposure.
- Substitution
- Replacement of a hazard with a less hazardous alternative that receives its own assessment.
- Engineering Control
- A physical or process change that isolates, encloses or reduces a hazard or exposure pathway.
- Administrative Control
- A rule, schedule, procedure or organisational measure that changes how exposure is managed.
- Personal Protective Equipment
- Equipment worn to place a barrier between the person and residual hazard.
Risk Assessment and the Control Hierarchy FAQ
What are the five steps of risk assessment?
Identify hazards, identify who may be harmed and how, evaluate likelihood and consequence, record findings and determine elimination or control, then review and update. Each step should retain enough information for the next person to understand the decision.
Why is personal protective equipment the last line of defence?
It does not remove the hazardous source and depends on correct selection, fit, use, maintenance and compatibility. Source and engineering controls usually provide protection that relies less on individual behaviour, while PPE remains important for residual exposure.
What makes a proposed control auditable?
Name the control target, responsible role, completion point, retained evidence, effectiveness measure and review trigger. A recommendation such as provide training is incomplete until the required behaviour, task context and evidence of sustained performance are specified.
Exam move
Memorise the hierarchy by asking what each level changes: source, substitute, process, organisation or wearer. Work one case per study session and force yourself to justify every downward move. Finish by writing an owner and an effectiveness measure for each selected control.
Use a repeatable assessment sequence: define the activity and boundaries, identify hazards and exposed people, examine existing controls, judge risk with stated assumptions, select additional controls, assign action, and review residual risk. Practise on routine, non-routine and emergency conditions because a control that works during normal production may fail during cleaning, maintenance, breakdown or time pressure.
Treat the matrix as a communication aid rather than an automatic decision machine. When assigning likelihood and consequence, cite the case evidence, explain uncertainty and test whether a different reasonable rating would alter the action priority. Separate initial risk from residual risk and never lower a rating merely because an action has been proposed; the new judgement belongs after implementation evidence.
Build a hierarchy table for each scenario. In the elimination row, ask whether the activity, material or exposure can be removed. In substitution, compare the full hazard profile of alternatives. For engineering controls, state the physical separation, enclosure, isolation or automation mechanism. For administrative measures, specify the work system and foreseeable human constraints.
For personal protective equipment, address selection, fit, compatibility, maintenance and actual use. Combine controls where no single measure is sufficient, but do not let a bundle of weak administrative steps masquerade as source control. Add implementation realism by naming the accountable role, consultation needed, resources, completion point and verification method.
Distinguish installation from effectiveness: a guard can be present yet defeated, ventilation can run yet fail to capture, and training can occur without changing practice. For exam-style responses, structure the answer as judgement, evidence, control choice and verification. Include one sentence explaining why a superficially easier lower-order option is inadequate.
Finally, revisit the assessment when work, equipment, personnel, knowledge or legal requirements change, or when monitoring and incidents contradict the original assumptions. A good risk assessment is a maintained reasoning record, not a once-completed form.
