COSHH Control Measures: The Hierarchy of Control Explained

What Are COSHH Control Measures? (Short Answer)

COSHH control measures are the steps you take to prevent or reduce workers' exposure to hazardous substances. Under the Control of Substances Hazardous to Health Regulations 2002, you must work through a set order — the hierarchy of control — starting with preventing exposure altogether and only relying on personal protective equipment (PPE) as a last resort.

The law is specific about the order. Regulation 7 requires that exposure is "either prevented or, where this is not reasonably practicable, adequately controlled," and it sets out the priority for control measures. Get the order wrong — reaching for masks and gloves first — and you have not met the duty, even if everyone is wearing PPE. The rest of this guide explains the hierarchy and the eight principles of good practice that sit behind it.

The Hierarchy of Control

The COSHH hierarchy runs from most effective to least effective. You start at the top and only move down when the higher option is not reasonably practicable.

Eliminate — Stop using the hazardous substance entirely. Can the job be done without it? This removes the risk completely.
Substitute — Replace it with something less hazardous, or change the process so less of the substance is released. Regulation 7 actually names substitution as the preferred step where prevention is not possible: replace the substance "with a substance or process which... either eliminates or reduces the risk."
Engineering controls — If you must use the substance, control exposure at source. This includes enclosing the process, automating handling, and local exhaust ventilation (LEV) to capture contaminants before they spread.
Administrative controls — Reduce exposure through how work is organised: safe systems of work, limiting time spent on a task, restricting who does it, training, and good housekeeping.
Personal protective equipment (PPE) — Gloves, goggles, respirators, and aprons. Regulation 7 places PPE last: it is provided "where adequate control of exposure cannot be achieved by other means... in addition to" the other measures.

PPE is genuinely the last line of defence. It only works if it fits properly, is worn every time, and is maintained — which is exactly why it is less reliable than designing the hazard out. A worker who forgets their mask for ten minutes is unprotected; an enclosed process protects them whether they remember or not.

The Eight Principles of Good Control Practice

Here is the part many guides skip. Regulation 7(7) says control is only "adequate" if you apply the principles of good practice set out in Schedule 2A. There are eight of them, and they apply to every COSHH situation.

A useful, counterintuitive point from the HSE's guidance: these eight principles are not ranked. The first is not more important than the last — you have to apply all of them together to achieve effective, reliable control.

The eight principles, in the order Schedule 2A lists them:

(a) Design and operate processes and activities to minimise emission, release and spread of substances hazardous to health.
(b) Take into account all relevant routes of exposure — inhalation, skin absorption and ingestion — when developing control measures.
(c) Control exposure by measures that are proportionate to the health risk.
(d) Choose the most effective and reliable control options which minimise the escape and spread of substances hazardous to health.
(e) Where adequate control cannot be achieved by other means, provide — in combination with other control measures — suitable PPE.
(f) Check and review regularly all elements of control measures for their continuing effectiveness.
(g) Inform and train all employees on the hazards and risks from the substances they work with, and on the use of the control measures.
(h) Ensure that introducing control measures does not increase the overall risk to health and safety.

Principle (h) is the one people forget. A control that fixes one problem but creates another — a respirator that makes a hot job dangerous, or an enclosure that traps fumes near the operator — is not good control.

Applying This in a Small Business

You do not need a safety department to apply the hierarchy. Here is how it looks in practice.

A cleaning business using a strong degreaser works down the hierarchy like this: can we eliminate it (use a non-hazardous product)? If not, can we substitute a milder one? If we still need it, can we improve ventilation and reduce the quantity decanted? Train staff on safe use, then provide gloves and eye protection as the final layer.

A joinery workshop generating wood dust starts the same way: the dust cannot be eliminated, so the focus moves to engineering control — LEV on the saws and sanders — backed by housekeeping (no dry sweeping), exposure limits awareness, and RPE where the extraction cannot reach.

In both cases, the controls you decide on are recorded in your COSHH assessment — the assessment is where you show you worked through the hierarchy rather than defaulting to PPE. And once controls are in place, principle (f) means you keep checking they still work: LEV gets tested on schedule, and the assessment gets reviewed.

Control Measures Checklist

Can the substance be eliminated? If not, can it be substituted?
Are engineering controls (enclosure, LEV) in place where the substance is used?
Are administrative controls (safe systems, time limits, training) in place?
Is PPE used only as the final layer, not the first response?
Have all eight Schedule 2A principles been applied — including (h), no new risks?
Are controls recorded in the COSHH assessment?
Are controls checked and reviewed regularly for continuing effectiveness?

Keeping Controls on Track

Deciding on controls is the easy part. The hard part is principle (f) — checking, over months and years, that every control is still doing its job, across every substance and every site.

COSHHmate is being built to record the control measures for each substance alongside your COSHH assessments, so the controls you decided on stay visible and reviewable rather than buried in a one-off document. Pricing will be a flat monthly fee with no per-user charges. To get your COSHH compliance organised, join the waitlist.

Sources

This is general guidance based on the COSHH Regulations 2002 and published HSE guidance. Verify the control measures appropriate for your specific substances and processes against HSE guidance. Not legal or safety advice.