Study the hierarchy of control as a strict order: try to eliminate the hazard, then substitute a lower-hazard method, then engineer or isolate, then use administrative controls and training, and treat PPE as the last layer because it protects only the wearer and fails with the wearer. Learn which document does which job: risk assessments plan, method statements describe, permits authorise live high-hazard work, and toolbox talks brief. Practise by writing controls for paper scenarios, sorting them onto hierarchy rungs, and justifying the top choice out loud.
The hierarchy of control is a sequence, not a menu
The hierarchy orders controls from most to least effective: elimination, substitution, engineering or isolation controls, administrative controls, and finally PPE. A control that sounds safe can still be the wrong first answer when a higher rung exists.
Picture each rung with an engineering construction example. Elimination removes the hazard entirely, such as assembling steelwork on the ground so no one fits it at height. Substitution swaps in something less hazardous, like a water-based degreaser for a flammable solvent. Engineering controls guard the hazard at source: local exhaust ventilation at a weld, machine guarding, edge protection. Administrative controls shape behaviour through permits, briefings, and training. PPE comes last because it protects one person, only while worn and fitted, and leaves the hazard untouched.
That ordering is why, in the practice scenarios below, several options can all sound safe while only one is best. Offered 'brief the workforce', 'provide respirators', and 'install local exhaust ventilation' for a fume problem, all three reduce exposure, but ventilation guards the hazard at source and protects everyone nearby. Ask of every option: does this remove the hazard, guard it at source, or merely shield the worker from it?
- Elimination: can the task be done another way so the hazard never exists?
- Substitution: can a lower-hazard substance, tool, or method do the same job?
- Engineering: can a guard, ventilation, or barrier protect everyone at source?
- Administrative: can permits, training, or scheduling reduce exposure or error?
- PPE: what protects the individual once everything above is exhausted?
- Exercise: list five candidate controls for a hazard from your own work, force each onto a named rung, and check whether your first instinct lands on administrative controls or PPE when a higher rung exists.
Permits, risk assessments, method statements, and toolbox talks do different jobs
A risk assessment plans for hazards, a method statement describes how the work will be done, a permit to work authorises a specific high-hazard task to start, and a toolbox talk briefs the people doing it.
The cleanest distinction is timing and function. Risk assessments and method statements, often grouped as RAMS, are planning documents prepared before work starts: one asks what could harm someone and how it will be controlled, the other sets out the exact steps of the job. A permit to work is a live authorisation confirming that, at this moment, the isolation is applied, the gas test result is recorded, the fire watch is posted, and a named person may begin. A toolbox talk translates all of that into a short crew briefing.
This timing difference explains who signs each document and what voids it. A supervisor can brief a toolbox talk; a permit is issued and signed off by authorised people against defined conditions, and it is suspended or cancelled if conditions change, a shift ends, or the specified controls lapse. A scenario describing changed conditions overnight is testing whether you know the permit no longer stands as written, even though the risk assessment still exists in the office. Planning documents are revised; permits are stopped and reissued.
| Document | Core question it answers | When it lives |
|---|---|---|
| Risk assessment | What could cause harm here, and what controls will we apply? | Planning stage, before work; reviewed when the job or conditions change |
| Method statement | Exactly how will this job be carried out, step by step, and by whom? | Planning stage for non-routine or higher-risk tasks |
| Permit to work | Has this specific task been formally authorised and made safe right now? | Live on site, for defined high-hazard work such as hot work, confined space entry, or energy isolation |
| Toolbox talk | Does everyone on the crew understand today's hazards, controls, and stops? | Start of a shift or before a new or changed task |
Who decides what: matching each duty to the right role
Employers carry duties for safe systems of work, training, supervision, and suitable equipment and PPE. Workers must follow that training, use the controls provided, and report anything unsafe. Supervisors bridge the two by briefing, checking, and stopping unsafe work.
Role-matching questions work like a sorting exercise. If an option describes providing equipment, assessing risks, or arranging training, it maps to the employer. If it describes following instructions, using guards and PPE as instructed, and reporting defects or near misses, it maps to the worker. If it describes checking a permit condition, refusing to let an unfit colleague enter a confined space, or halting a task when a control fails, it maps to the supervising role. Practise labelling each sentence of a scenario with its actor before looking at the options.
Two boundary cases deserve deliberate attention. First, reporting is a worker duty, but acting on the report is not: a worker who notices a damaged scaffold should report it and keep clear rather than improvise a repair, because repair competence and authority sit elsewhere. Second, everyone has a general part in safety, so an option saying workers should take reasonable care of themselves and others is correct, while an option transferring the employer's system-of-work duty onto workers is not. The distinction is cooperation with arrangements versus creating them.
Worked scenario 1: an overhead valve replacement and the PPE trap
A pipefitter must replace a valve on a line above head height. The natural first answer is a harness, but the better decision checks whether the work can be lowered, shielded, or re-planned before any personal protection is discussed.
The mistake to rehearse avoiding: reaching for 'wear a harness with a suitable anchorage' as the first control. A harness is a genuine control and sometimes the necessary one, but here it is the lowest rung of the hierarchy applied first, and it protects only the fitter while leaving everyone else exposed to the same overhead task. The scenario is set up so that the plausible-sounding option and the hierarchy-correct option sit in the same list.
The stronger path: name the hazard first, working at height with a heavy component, then climb the rungs. Could the spool section be brought down, or the valve assembly made up at ground level and lifted complete? Could a scaffold platform with edge protection replace the beam walk? Only after those are ruled out as impracticable does personal fall protection enter, alongside rather than instead of collective measures. The hierarchy is the backbone of this subject, so an answer one rung too low sounds safety-conscious but skips its reasoning.
Worked scenario 2: a confined space entry and the improvised plan
An inspector needs to enter a vessel that previously held process material. The trap is practical-sounding improvisation, a torch and a colleague; the correct path runs through the permit system and its pre-entry conditions being confirmed first.
The mistake: 'test the atmosphere with a portable detector, enter with a colleague watching, and leave if you feel unwell.' It sounds responsible, but it treats life-critical checks as optional and reversible, and 'leave if unwell' is not a rescue plan. In an oxygen-deficient or contaminated atmosphere the person who realises something is wrong may be unable to leave, and an untrained colleague entering to help becomes a second casualty.
The better decision: no entry until a permit to work authorises it, with atmospheric test results recorded and within defined limits, ventilation in place, a trained person stationed outside in communication, and rescue arrangements ready before anyone crosses the boundary. Changed conditions matter too: if the vessel was opened yesterday and left overnight, conditions must be re-established, not assumed from the earlier check. Because atmospheres cannot be judged by senses and rescues cannot be improvised, any answer relying on personal judgement inside the space sequences the controls backwards.
Control-sorting exercise with a self-check rubric
Take a paper scenario, hot work near combustible insulation works well, write eight candidate controls, sort each onto a hierarchy rung, then circle the highest reasonably practicable control and justify it in one sentence before checking against the rubric.
Scenario: a welder must join a bracket to a structural member a metre from mineral insulation that can ignite. Write eight candidate controls, for example: remove the insulation locally; use a fire-resistant blanket shield; schedule the weld for a shutdown period; issue a hot work permit with a fire watch and extinguisher; brief the welder on the fire risk; issue flame-resistant clothing; substitute mechanical fixing for welding; inspect the area for smouldering after work ends. Sort each item onto a rung and mark the top practical choice.
Expect these observations on checking: mechanical fixing and removing the insulation sit at elimination or substitution, and one of them is likely your top practical choice, both easy to overlook because they change the job rather than guard it. The blanket, fire watch, and post-work inspection belong below the top choice. Rubric: all eight controls on a named rung; PPE below, not beside, administrative controls; at least one control that removes or replaces the hazard; a one-sentence justification naming the rung. If any check fails, rerun with manual handling or live equipment work.
A preparation sequence and readiness checks you can self-administer
Build the sequence around the two ideas this subject turns on: control ordering and document roles. Move from definitions, to the comparison table, to role-matching, to scenario writing, to mixed practice, finishing when the readiness checks feel automatic.
An adaptable sequence: first, learn the hierarchy rungs and write your own engineering construction example for each. Second, reconstruct the documents table from memory, including who signs each document and what voids it. Third, take any workplace anecdote and label every actor and action with employer, supervisor, or worker duties. Fourth, write out the two worked scenarios above from scratch, including the plausible mistake in each. Fifth, do mixed practice questions, such as this site's free practice material, and after each item write one line naming the rung or document that decided it.
Readiness checks, treated as learning milestones rather than pass predictions: state the hierarchy in order with an example per rung in under a minute; rebuild the four-document table, including which one is a live authorisation; sort ten mixed controls onto rungs without moving any twice; and narrate a permit scenario end to end, from planning documents through authorisation, changed conditions, and stop-work. For administrative questions such as validity, renewal, and booking, the current position is set and published by ECITB itself, so check ecitb.org.uk rather than relying on study material.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.