PECB ISO 45001 Foundation study materials
PECB ISO 45001 Foundation study resources

Hierarchy of Controls vs. PPE Habit

PECB ISO 45001 Foundation ยท Put your knowledge to work in context.

All case studies

Hierarchy of Controls vs. PPE Habit

A metal fabrication workshop (60 workers) has a persistent noise problem. Area noise levels are 92โ€“95 dB(A) during grinding and cutting. The current control is mandatory hearing protection (earplugs and earmuffs), with signage and periodic audiometry. Audiometry results show three workers with early noise-induced hearing loss (a notifiable occupational disease in the jurisdiction). Workers complain the earmuffs are uncomfortable in summer and compliance is estimated at 70%. The production manager proposes buying 'better' earmuffs and increasing signage. The OH&S manager wants to apply the hierarchy of controls. The firm is certified to ISO 45001 and Clause 8.1.2 is in scope.

1. Apply the hierarchy of controls to this situation. What is wrong with the production manager's proposal, and what should be done first?

Read the worked answer

The production manager's proposal relies on PPE and administrative controls, which sit at the bottom of the hierarchy. Under 8.1.2, the organisation must establish a process for eliminating hazards and reducing OH&S risks using the hierarchy:

  1. Elimination - can the noisy task be eliminated or relocated?
  2. Substitution - can quieter equipment or processes be used (e.g., quieter blades, damping, different cutting method)?
  3. Engineering controls - enclosures, acoustic barriers, isolation of the grinding area, vibration damping, remote operation.
  4. Administrative controls - job rotation, limiting exposure time, signage, training.
  5. PPE - hearing protection, as the last line of defence.

The proposal is wrong because:

  • It treats PPE as the primary control when it should be the last resort.
  • PPE effectiveness depends on correct use and fit, and compliance is estimated at 70% - so the actual protection is far below the assumed level. The three audiometry cases are evidence that the current control is not effective.
  • Better earmuffs do not address the source of the noise; they merely attempt to mitigate exposure.

First action: an engineering assessment of the grinding and cutting operations to identify substitution or engineering controls (enclosures, damping, quieter tooling, separation of the noisy area). PPE should continue in the interim while engineering controls are implemented.

2. The three audiometry cases are described as a notifiable occupational disease. How does this affect the organisation's obligations under ISO 45001, and what does it tell you about the effectiveness of controls?

Read the worked answer

A notifiable occupational disease is a serious signal, not a routine data point. It affects obligations in several ways:

  • 9.1.2 evaluation of compliance - notifiable diseases trigger legal reporting and may trigger regulatory inspection. The organisation must evaluate and demonstrate compliance with applicable legal requirements (6.1.3).
  • 10.2 nonconformity and corrective action - an occupational disease is an incident with a health outcome. The organisation must react, investigate, determine cause, implement action, and review effectiveness.
  • 9.1.1 monitoring and measurement - audiometry is a monitoring activity; the results show the control is failing. The organisation must act on monitoring results, not merely record them.
  • 6.1.2 hazard identification - noise is a recognised hazard; the risk assessment should have identified the exposure and the inadequacy of PPE-only control.
  • 8.1.2 hierarchy of controls - the disease is evidence that the chosen control (PPE) was not adequate.

What it tells you about effectiveness: the controls are not effective. Three cases in a 60-person workforce is a significant cluster. The 70% compliance estimate confirms the PPE control is unreliable. The organisation cannot claim the risk is controlled; it must escalate to engineering controls and verify effectiveness through repeat audiometry and noise monitoring.

3. The production manager argues that 'we provide the PPE and train people, so we have done our duty'. Evaluate this against 8.1.2 and the concept of residual risk.

Read the worked answer

The argument confuses providing a control with controlling the risk.

  • 8.1.2 requires the use of the hierarchy of controls, with PPE as the last resort. Providing PPE without first attempting elimination, substitution, and engineering controls is a failure to apply the hierarchy.
  • Residual risk is the risk remaining after controls are applied. At 92โ€“95 dB(A), even correctly worn earmuffs may not reduce exposure below the action level, and at 70% compliance the actual residual risk is much higher than the assumed residual risk. The organisation must assess residual risk realistically, not assume the PPE performs as labelled.
  • Training and provision are inputs, not outcomes. The standard requires controls to be effective (9.1.1). The audiometry cases demonstrate they are not.
  • Consultation and participation (5.4) - workers have reported discomfort; their feedback is relevant evidence that the control is not workable, and it should have been acted on.

The correct judgement: the duty is to reduce risk so far as is reasonably practicable, using the hierarchy, and to verify that the controls work. 'We provided PPE' is not a defence when the evidence shows the risk is not controlled.