skills/wsh-risk-assessment/references/control-selection.md

# Risk Control

## Definition

Risk control is the process of eliminating hazards or reducing risks to an acceptable level.

Control measures should follow the Hierarchy of Control and should be selected based on the nature of the hazard, the level of risk, and the practicability of implementation. Risk controls should reduce risks to As Low As Reasonably Practicable (ALARP) and should not introduce new or unintended hazards. Apply Low, Medium, or High labels only when the organisation supplies an authoritative risk-band scheme. Where that scheme requires action or work cessation, follow its stated rule. Otherwise report the numerical score, explain the urgency from credible consequences and control weakness, and do not invent thresholds. Residual risks should be reviewed after controls are implemented and verified effective.

---

# Hierarchy of Control

Controls should be considered in the following order, with preference given to higher-level controls that eliminate or reduce hazards at the source.

The hierarchy applies to all hazard categories, including:

* Chemical hazards
* Biological hazards
* Ionising radiation hazards (e.g. radioactive materials, X-ray generating equipment)
* Non-ionising radiation hazards (e.g. lasers, ultraviolet radiation, infrared radiation, radiofrequency and microwave sources)
* Physical hazards
* Mechanical hazards
* Electrical hazards
* Ergonomic hazards
* Psychosocial hazards

## 1. Elimination

Remove the hazard completely so that exposure is no longer possible.

Examples:

* Remove hazardous process.
* Remove need to work at height.
* Eliminate use of hazardous chemicals.
* Eliminate use of infectious biological agents where alternatives are available.
* Eliminate use of radioactive materials where non-radioactive alternatives are available.
* Eliminate use of lasers where non-laser technologies can achieve the same outcome.
* Design out manual handling requirements through automation or process redesign.

Key consideration:

Elimination is the most effective control because it removes the hazard entirely rather than managing exposure.

---

## 2. Substitution

Replace the hazard with a safer alternative that presents a lower level of risk.

Examples:

* Replace xylene with a lower-toxicity solvent.
* Replace glass with plastic.
* Use less hazardous chemicals.
* Replace Risk Group 2 biological agents with non-pathogenic strains where suitable.
* Replace higher-activity radioactive sources with lower-activity sources where practicable.
* Replace Class 4 lasers with lower-class lasers where technically feasible.
* Substitute ultraviolet curing systems with lower-risk technologies where appropriate.
* Substitute powdered chemicals with pellets or solutions to reduce dust generation.

Key consideration:

The substitute should be assessed to ensure it does not introduce equal or greater risks.

---

## 3. Engineering Controls

Isolate people from hazards through physical design features or engineered systems.

Examples:

### Chemical

* Fume hoods
* Local exhaust ventilation
* Closed transfer systems
* Flammable storage cabinets
* Corrosives cabinets
* Gas cabinets
* Secondary containment

### Biological

* Biosafety cabinets
* Biological safety isolators
* Negative-pressure containment facilities
* HEPA filtration systems
* Sharps safety devices
* Hands-free handwashing facilities

### Ionising Radiation

* Shielding for radioactive sources
* Shielded storage containers
* Lead barriers
* Remote handling tools
* Interlocked irradiation equipment
* Shielded X-ray enclosures

### Non-Ionising Radiation

* Laser beam enclosures
* Beam stops
* Laser curtains
* Key-switch controls
* Interlocked laser rooms
* UV shielding screens
* RF shielding and enclosure systems

### General

* Machine guarding
* Interlocks
* Physical barriers
* Emergency shut-off systems
* Automated dispensing systems

Key consideration:

Engineering controls are generally more reliable than administrative controls because they do not depend heavily on human behaviour.

---

## 4. Administrative Controls

Change the way work is planned, organised, supervised, or performed.

Examples:

### Chemical

* Chemical inventory management
* SDS review
* Chemical compatibility assessments
* Waste management procedures
* Emergency spill response procedures

### Biological

* Biosafety training
* Biological agent registration and approval processes
* Exposure response procedures
* Decontamination procedures
* Vaccination programmes where applicable

### Ionising Radiation

* Radiation safety training
* Personal dosimetry programmes
* Radiation area monitoring
* Controlled area designation
* Radiation work authorisation procedures

### Non-Ionising Radiation

* Laser safety training
* Laser user authorisation
* Alignment procedures
* Laser hazard area designation
* UV exposure management procedures

### General

* Safe Work Procedures
* Training
* Supervision
* Permit-to-work systems
* Signage
* Access restrictions
* Job rotation programmes
* Pre-task briefings
* Competency assessments

Key consideration:

Administrative controls rely on consistent compliance and should normally be used to supplement higher-level controls rather than replace them.

---

## 5. Personal Protective Equipment

Provide personal protection against residual risks that remain after higher-level controls have been implemented.

Examples:

### Chemical

* Chemical splash goggles
* Chemical-resistant aprons
* Chemical-resistant gloves selected for compatibility and breakthrough resistance
* Respirators

### Biological

* Laboratory coats
* Disposable protective clothing for contamination control
* Medical gloves
* Respiratory protection where required
* Face shields

### Ionising Radiation

* Personal dosimeters
* Lead aprons where applicable
* Thyroid shields where applicable

### Non-Ionising Radiation

* Laser protective eyewear appropriate for the wavelength and optical density
* UV protective face shields
* UV protective clothing

### General

* Safety glasses
* Safety footwear
* Hearing protection
* Fall protection equipment where required

Key consideration:

PPE is the least effective control because protection depends on correct selection, fit, maintenance, and user compliance.

---

# Control Selection Principles

Effective risk control should:

* Prioritise elimination where practicable.
* Prioritise controls closer to the hazard source.
* Avoid relying solely on PPE.
* Use multiple layers of protection where necessary.
* Be practical and sustainable.
* Address both safety and health risks.
* Address chemical, biological, ionising radiation, and non-ionising radiation hazards where applicable.
* Consider the entire chemical lifecycle from procurement to disposal.
* Consider biological containment, decontamination, and waste management requirements.
* Consider radiation exposure pathways, shielding requirements, and regulatory controls.
* Consider routine, non-routine, maintenance, emergency, and abnormal operating conditions.
* Be compatible with operational requirements and user needs.
* Be clearly communicated to affected personnel.
* Be monitored periodically to verify effectiveness.
* Be reviewed whenever there are changes to processes, equipment, substances, personnel, legislation, or incident findings.

---

# Verification of Control Effectiveness

Implementation of controls does not automatically mean risks have been adequately managed. Controls should be verified to ensure they are functioning as intended.

Examples of verification methods:

* Workplace inspections
* Safety audits
* Exposure monitoring
* Radiation surveys
* Air sampling
* Biological containment certification
* Fume hood performance testing
* Biosafety cabinet certification
* Laser safety inspections
* Health surveillance programmes
* Competency assessments
* Observation of work practices
* Incident and near-miss reviews
* Preventive maintenance records

Where controls are found to be ineffective, additional measures should be implemented and the risk assessment should be reviewed.

---

# Residual Risk Assessment

After implementing additional controls, the residual risk should be reassessed.

Residual risk assessment should:

1. Review the effectiveness of implemented controls.
2. Re-evaluate likelihood and severity.
3. Determine the revised Risk Prioritisation Number (RPN).
4. Confirm whether the residual risk is acceptable.
5. Identify any further controls required.

The objective is to ensure that residual risks are reduced to a level that is acceptable and As Low As Reasonably Practicable (ALARP).