Controlling risks
The hierarchy of control
Controls are not equal. The recognised hierarchy runs: eliminate the hazard (remove the task or substance); substitute with something less hazardous; engineering controls (enclose, isolate, guard, ventilate, damp down noise); administrative controls (safe systems of work, permits to work, training, rotation, signage); and finally personal protective equipment. PPE is last for good reason: it protects only the wearer, depends entirely on correct selection, fit, use and maintenance, and fails silently when someone removes it for two minutes.
Collective controls that protect everyone all the time are preferred over personal controls that depend on behaviour. Where risk cannot be removed, it should be reduced so far as is reasonably practicable - the risk must be weighed against the time, trouble and cost of further controls, and cost can only justify inaction where it is grossly disproportionate to the risk.
Controls need a life cycle: someone must own them, monitor them (for example, thorough examination and testing of local exhaust ventilation, guarding checks, PPE inspections) and maintain them. Emergency arrangements, first aid and rescue provision are part of the control package, not an afterthought.
Traps: offering PPE as the first answer; thinking training alone controls a risk; confusing 'eliminate the hazard' with 'eliminate the job'; forgetting to identify the residual risk that remains after controls, which still needs managing.
Rule of thumb: for any control ask - does it remove the hazard, separate people from it, or merely reduce exposure? Choose the highest level that is reasonably practicable.