What Are Control Measures? Your 2026 H&S Solutions Guide

2 days ago
12 min read

You've finished the risk assessment. The hazards are listed. The scoring is done. The action column is staring back at you.

That's usually the point where a new Health and Safety manager realises the hard part isn't spotting risk. It's deciding what will control it in a live workplace where people are busy, budgets are real, managers are stretched, and operations still need to run.

That's what control measures are. They're the practical steps that reduce or remove risk. Not just the obvious physical safeguards, but the full set of barriers, systems, checks, and behaviours that stop someone getting hurt or stop a process drifting into failure. In UK practice, they also have to stand up to scrutiny. A measure that sounds sensible in a meeting can still fail in use if it relies on perfect behaviour, isn't maintained, or was never properly embedded into the job.

From Risk Assessment to Real Protection - Controls aren't just equipment
The Hierarchy of Controls Explained - What the hierarchy is really telling you - A simple wet floor example
How to Choose Proportionate and Effective Controls - Reasonably practicable means defensible in context - What survives a real risk assessment
Implementing and Monitoring Control Measures - Implementation is where many controls fail - How to monitor whether a control still works
Control Measures in Action Across UK Sectors - Construction - Corporate offices - Hospitality and events - Manufacturing
A Practical Checklist for Documenting Controls - What your documentation needs to show - Using monitoring data to keep controls alive

From Risk Assessment to Real Protection

A completed risk assessment without effective controls is only half a job. It identifies where harm could happen, but it doesn't yet protect anyone. Control measures are the point where assessment turns into action.

In UK health and safety practice, control measures are the steps used to reduce or remove risk after hazards are identified, and the hierarchy of control is the standard framework used to choose them. The modern approach sits within the broad duties created by the Health and Safety at Work etc. Act 1974 and the HSE-led model of elimination, substitution, engineering controls, administrative controls, and PPE.

A good example is a storeroom with repeated manual handling issues. The risk assessment may identify awkward lifting, restricted space, and poor stacking. None of that changes until someone redesigns storage heights, changes the delivery method, introduces the right handling equipment, and makes sure staff know the safe system of work. The control measure isn't the document. It's the change to the task.

Controls aren't just equipment

New managers often assume controls mean guards, barriers, signs, and PPE. Those matter, but they're only part of the picture. A control can also be:

A physical safeguard such as machine guarding or local extraction.
A work method such as a permit, isolation sequence, or traffic route.
A people measure such as training, supervision, or competence checks.
A verification step such as inspection, testing, or maintenance.

Practical rule: If the measure doesn't reduce either the likelihood of harm or the severity of harm, it isn't a control. It's admin around the edges.

That's why review matters as much as selection. If your workplace has changed since the assessment was written, the controls may already be out of date. A useful prompt is this guide on how often risk assessments should be reviewed, because timing, change, and drift are where many systems weaken.

The Hierarchy of Controls Explained

The hierarchy of controls is the standard UK framework for prioritising risk reduction measures. It helps you decide which controls are likely to hold up in day-to-day operations, and which ones rely too heavily on people getting everything right every time.

Start with the controls that remove the hazard or separate people from it. Use lower-level controls where they support the overall arrangement or where higher-level options are not reasonably practicable. That order matters for a legal reason as well as a practical one. If an incident is investigated, you may need to show why you relied on supervision, procedures, or PPE instead of changing the task, equipment, or environment first.

An infographic showing the five levels of the hierarchy of controls for workplace safety and risk management.

What the hierarchy is really telling you

In practice, the hierarchy is less about memorising five labels and more about judging how dependable a control will be under pressure. The Health and Safety Executive guidance on controlling risks at work reflects the same principle. Tackle the risk at source where possible, then build down only where needed.

That order reflects how controls behave on a real site, not just how they read in a risk assessment.

Elimination removes the hazard completely. If a task can be redesigned so nobody works at height, the fall risk from that activity is removed.
Substitution replaces the hazard with a safer option. That might mean using a less hazardous substance, a quieter machine, or a different access method.
Engineering controls reduce exposure by design. Guards, interlocks, local exhaust ventilation, enclosures, and fixed barriers all sit here.
Administrative controls reduce risk through the way work is organised. Safe systems of work, permits, supervision, job rotation, signage, and scheduling fit this level.
PPE protects the individual at the point of exposure. It only works if it is suitable, fitted, worn, maintained, and used alongside other controls.

Here is the comparison that usually helps managers make better decisions quickly.

Control Level	Effectiveness	Example (Noise Hazard)	Reliance on Worker Behaviour
Elimination	Highest	Remove the noisy task from the process	Low
Substitution	High	Replace equipment with a quieter alternative	Low to medium
Engineering Controls	Strong	Install acoustic enclosures or barriers	Low
Administrative Controls	Moderate	Limit exposure time and schedule noisy work	High
PPE	Lowest as a primary control	Issue hearing protection	Very high

A common mistake is treating the hierarchy as a rule that forces you to choose only one level. Good control strategies usually combine several. For noise, for example, you might buy quieter equipment, fit enclosures, restrict access during peak exposure, and issue hearing protection for residual risk. The key point is that PPE should not be carrying the whole arrangement if stronger upstream controls are available.

A simple wet floor example

A wet floor problem shows the difference clearly. If a corridor is slippery because an appliance keeps leaking, elimination means removing the leak by repair, replacement, or redesign. Substitution could mean changing to equipment that does not create the same spill hazard. Engineering controls include drainage, slip-resistant flooring, bunding, or separating pedestrians from the affected area. Administrative controls cover inspection routines, cleaning response, and warning signs. PPE means slip-resistant footwear where the task justifies it.

The lower you go in the hierarchy, the more the system depends on workers noticing the hazard, remembering the instruction, and following it consistently while the job is still getting done. That is the trade-off new managers need to recognise early. Lower-level controls are often easier to introduce, but they are also easier to bypass, forget, or erode over time.

For a short visual explanation of the model in practice, this walkthrough is useful:

https://www.youtube.com/embed/7kwW_1wz0g0

The hierarchy helps you choose controls that are effective, sustainable, and defensible. It does not stop you using lower-level measures. It stops you mistaking them for stronger ones.

How to Choose Proportionate and Effective Controls

Choosing controls isn't about taking the top item in the hierarchy and forcing it into every situation. It's about selecting measures that are effective, feasible, sustainable, and legally defensible in the environment you manage.

That's where many risk assessments become unrealistic. A control can sound excellent in theory and still be fragile in practice because the site layout is poor, supervision is inconsistent, contractors vary in competence, or the measure slows the job so much that people bypass it.

Reasonably practicable means defensible in context

In UK practice, the test is whether risk has been reduced so far as is reasonably practicable. That standard pushes you to weigh the level of risk against what is needed to control it, then justify your decision sensibly. It doesn't mean choosing the cheapest option. It means choosing a proportionate one that stands up when someone asks, “Why this control, and how do you know it works?”

A sensible decision usually considers:

The nature of the hazard. A fall risk, chemical exposure, and stress risk won't be controlled in the same way.
Who is exposed. Employees, contractors, visitors, vulnerable people, and the public create different demands.
How often exposure happens. Repeated exposure usually justifies stronger upstream controls.
Whether the measure will survive routine operations. If the job depends on speed, attention, or competing priorities, weak controls tend to erode first.

What survives a real risk assessment

The practical question behind what are control measures is often which controls will survive a UK risk assessment. A control that looks good on paper can fail if it depends on perfect behaviour. More effective options are elimination, substitution and engineering controls, because they're more sustainable in a specific environment than weaker administrative or PPE layers, as outlined in OSHA's hierarchy guidance on feasibility and control selection.

That's why layered control is usually the right answer. Not because one weak measure becomes strong by company, but because each layer covers a different failure point.

Consider a kitchen with knife injuries and rushed prep. A realistic set of controls might include better-prepared ingredients from suppliers, safer workstation layout, suitable knife storage, training in handling and sharpening, supervision for new starters, and cut-resistant PPE where residual risk remains. No single control solves the issue. Together, they make the task far more resilient.

Decision test: If your chosen control disappears the moment a supervisor turns their back, it isn't strong enough on its own.

Documentation matters here. Record not just what you accepted, but what you rejected and why. If elimination wasn't possible, say why. If a stronger engineering option was not feasible at one site but is planned during refurbishment, note that too. That's how a risk assessment becomes defensible instead of generic.

Where organisations need help turning broad duties into practical systems, one option is KODOBI's workplace health and safety consultancy, which supports UK employers with advisory work, management systems, audits, and sector-specific implementation.

Implementing and Monitoring Control Measures

A control measure only starts to matter when it is put into the job properly. Plenty of organisations select sensible controls, then undermine them through weak rollout, poor communication, no maintenance, or no follow-up. The result is a paper-safe workplace and a live operation that behaves very differently.

A five-step process diagram illustrating how to implement and monitor safety control measures in a workplace.

Implementation is where many controls fail

UK guidance emphasises that a control is only effective if it is embedded in a supportive system. Procedures, training, supervision, maintenance, and auditing are required. The risk assessment must document and link each control to a monitoring method to prove risk is reduced to so far as is reasonably practicable.

That changes how you should implement controls. Don't just install or issue. Build the surrounding system.

A practical sequence looks like this:

Define the control clearly. State what the measure is supposed to do and which hazard pathway it addresses.
Assign ownership. Someone must be responsible for introducing it, maintaining it, and checking it.
Translate it into work. Write or revise the safe system of work, permit, SOP, or briefing note.
Train the people involved. Not generic awareness. Task-specific instruction that matches the actual environment.
Verify use on the ground. Check whether the job is now being done the new way.

A machine guard, for example, isn't fully implemented when it's bolted on. It also needs lock-off arrangements, cleaning instructions, maintenance access controls, operator training, and supervision that doesn't tolerate bypassing.

For accountability on this point, it helps to be clear about who is in charge of workplace health and safety accountability, because controls fail quickly when responsibilities are blurred.

How to monitor whether a control still works

Monitoring isn't only a formal audit. It's any structured method that tells you whether the control still reduces risk.

Use a mix of methods:

Inspections to confirm physical controls remain present and serviceable.
Observation to see whether the task is really being done as intended.
Maintenance records to confirm testing, servicing, and replacement happen.
Incident and near-miss review to identify where barriers failed or were missing.
Worker feedback to spot impractical controls before they are bypassed.

A control that is hard to use, easy to defeat, or never checked won't stay effective for long.

Good monitoring also looks for drift. A storeroom becomes crowded. A guard is removed for cleaning. A manager starts allowing shortcuts on late shifts. None of these changes may trigger a formal review immediately, but all of them can weaken the control system. That's why the best organisations treat implementation and review as a continuous loop rather than a one-off action.

Control Measures in Action Across UK Sectors

The principles are consistent. The hazards are not. What works in a factory can be pointless in an office, and a measure that suits a theatre or event venue may be unworkable on a construction project. Control measures only make sense when they fit the task, the people, and the setting.

The need is hardly theoretical. The HSE's latest UK figures report 138 fatal workplace injuries in 2024/25 and 604,000 non-fatal injuries in 2023/24, while around half of UK employers report stress-related absence. That's why sector-specific, layered controls still matter across both physical and psychosocial risk areas, as noted in this summary of current UK workplace injury and stress figures.

Construction

Construction tests whether a manager understands the difference between visible controls and reliable controls. A harness is visible. Designing out work at height is reliable.

For work at height, stronger controls include avoiding the task entirely where possible, using prefabrication, bringing work to ground level, or choosing collective protection such as properly designed edge protection and working platforms. Lower-level measures still have a place, but relying mainly on PPE in a changing site environment is usually a sign the earlier decisions were weak.

Other examples include:

Traffic management through segregated routes and delivery planning, rather than only hi-vis and warning signs.
Temporary works control through design, sequencing, and inspection, not just verbal instructions.
Dust exposure control through suppression or extraction before RPE is considered.

Corporate offices

Office environments can look low risk and still contain poor controls. DSE issues, slips, lone working, contractor management, and work-related stress are often handled too lightly because the hazards are less dramatic.

A good office control strategy usually combines workstation assessment, task design, reasonable adjustment where needed, housekeeping, and clear escalation routes for wellbeing concerns. Stress risk is a good example of why administrative controls can be weak if they stand alone. Telling managers to “keep an eye on workload” isn't enough if staffing, deadlines, and reporting lines make that impossible in practice.

The better controls are often upstream. Job design, realistic resourcing, and competent line management reduce the hazard more effectively than awareness campaigns on their own.

In offices, weak controls often hide behind polite language. The risk is still real if the work system keeps creating it.

Hospitality and events

This sector punishes assumptions. Layout changes, transient workers, public access, alcohol, contractors, and time pressure all complicate control.

Fire precautions, crowd flow, kitchen safety, manual handling, and late-night transport risks all need layered measures. For events, effective controls often start before the day itself. Entry arrangements, occupancy limits, queue management, contractor coordination, emergency roles, and communications planning are usually more important than whatever sign goes up at the door.

In kitchens and bars, sensible controls often include equipment selection, maintenance, ventilation, separation of hot and cold pathways, cleaning regimes that don't introduce slip hazards, and competent supervision during peak service. PPE has a place, but it won't compensate for a chaotic layout.

Manufacturing

Manufacturing usually makes the value of strong controls obvious. Machinery, noise, chemicals, vehicles, and repetitive processes expose workers to hazards that are persistent and unforgiving.

Reliable controls here include fixed guarding, interlocks, extraction, segregation, automated handling where possible, chemical substitution, and disciplined maintenance. Administrative controls still matter, but they should support the engineered system, not carry it.

This is also the sector where monitoring maturity often shows up most clearly. A production line can appear stable while small variations build into a bigger problem. Managers who understand process control tend to spot degradation earlier because they don't wait for injury before asking whether the system has shifted.

A Practical Checklist for Documenting Controls

Documentation is where many decent control decisions either become defensible or become vague. If your records only say “staff trained” or “PPE provided”, you haven't shown much. A useful risk assessment should make it obvious what the hazard is, what barrier has been chosen, who maintains it, and how anyone will know it's still working.

What your documentation needs to show

Use this as a practical checklist when recording controls:

Link each control to a specific hazard. Don't list generic precautions detached from the task.
State the control type. Identify whether it is elimination, substitution, engineering, administrative, or PPE.
Explain the reason for selection. Briefly record why this measure is suitable in that environment.
Record rejected options where relevant. This helps show your decision-making was deliberate.
Name the owner. Someone must be accountable for implementation and upkeep.
Set the monitoring method. Inspection, observation, maintenance, audit, or incident review should be specified.
Define review triggers. Changes in layout, staffing, equipment, contractors, or incidents should prompt reassessment.

A strong audit trail also helps when sites differ. Multi-site organisations often make the mistake of copying the same controls across all locations, then ignoring differences in access, occupancy, storage, or supervision.

For a practical benchmark, this kind of health and safety audit checklist is useful because it pushes you to test whether documented controls are visible in the workplace, not just present in files.

Using monitoring data to keep controls alive

A key development in control-measure thinking was Walter Shewhart's invention of control charts in the 1920s. In statistical process control, a process is considered in control when variation stays within defined limits, typically three standard deviations above and below the mean, allowing managers to detect when a process has changed and corrective action is needed, as explained in this overview of statistical control charts and process variation.

You won't use control charts for every hazard, but the underlying lesson is valuable in any workplace. Don't just ask whether a control exists. Ask whether the process is stable, whether variation is increasing, and whether early signs show the control is weakening.

That mindset improves ordinary safety documentation. Instead of “weekly checks completed”, record what the checks are meant to detect. Instead of “training delivered”, record what competent performance looks like. Instead of waiting for an accident, look for signs of drift.

Good control measures are never just chosen. They're designed, embedded, checked, and refreshed.

KODOBI provides health and safety consultancy for UK employers, including retained advisory support, audits, fire risk assessments, training, and practical help with designing control measures that are proportionate, workable, and properly documented. If you need an external view on whether your current controls would stand up in day-to-day use, that's the kind of problem they support organisations with across construction, offices, hospitality, manufacturing, education, and other operational settings.