The law · Reviewed September 2026
The hierarchy of control measures
What regulation 6 actually requires, why three of the controls sit at the same level, and where personal protective equipment belongs.
New Zealand’s hierarchy is not the six-rung ladder used in some other countries. It is two duties and one ranked list, and the ranking has a flat section in the middle that is easy to miss.
The two duties
Section 30 of the Health and Safety at Work Act 2015 sets the order. A PCBU must eliminate risks to health and safety so far as is reasonably practicable. If it is not reasonably practicable to eliminate a risk, the PCBU must minimise it so far as is reasonably practicable.
Elimination is not the first option on a menu. It is the duty, and minimisation is what you fall back to only when elimination is not reasonably practicable. A Task Analysis that goes straight to controls without recording why the hazard could not be removed has skipped the first question the Act asks.
What counts as minimising
Regulation 6 of the Health and Safety at Work (General Risk and Workplace Management) Regulations 2016 sets out how a risk must be minimised. Select any control below to see the wording and what it looks like on a job.
HSWA s30. A PCBU must eliminate risks to health and safety so far as is reasonably practicable. This is the duty, not the first item on a menu of options.
On site it is the question asked before any control is written down: can the work be done without the hazard at all? Prefabricating at ground level rather than cutting at height, or having the service isolated before the excavation starts, eliminates the risk rather than managing it. If elimination is reasonably practicable, the rest of this list does not apply.
If elimination is not reasonably practicable, minimise
These three sit at the same level in reg 6
Reg 6. Substituting, wholly or partly, the hazard giving rise to the risk with something that gives rise to a lesser risk.
A water-based product instead of a solvent-based one. A smaller machine that does not need to track across the slope. Partial substitution counts: the regulation says wholly or partly.
Reg 6. Isolating the hazard giving rise to the risk to prevent any person coming into contact with it.
Hard barriers around the excavation, a locked and tagged board, an exclusion zone under the lift. Isolation fails when it depends on someone choosing to stay out, so the test is whether a person could still reach the hazard by doing something ordinary.
Reg 6. Implementing engineering controls, being physical controls that reduce the risk.
Edge protection, guarding, on-tool extraction, benching or shoring a trench, mechanical lifting instead of manual. These work whether or not the person is thinking about them, which is what puts them above the two levels below.
Reg 6. Implementing administrative controls, such as safe work procedures, training and supervision.
A permit, a spotter, a sequence that keeps trades apart, a briefing. Useful and often necessary, but they control the risk by changing what people do, so they depend on people doing it every time, including at the end of a long day.
Reg 6. Providing personal protective equipment.
WorkSafe is direct about where this sits: “PPE should only be used when other control measures alone cannot adequately eliminate or minimise risks,” and “PPE should not be the first or only control measure considered, and we expect PCBUs to give preference to other control measures that protect multiple at-risk workers at once.”
That last clause is the reasoning. A guard rail protects everyone who walks past it. A harness protects one person, correctly fitted, that day.
Select any control to see what the regulation says and what it looks like on site. More than one can apply at once, and a combination is usually better than any single control.
In list form, the same thing:
- Substitution, wholly or partly, of the hazard with something that gives rise to a lesser risk.
- Isolation of the hazard, to prevent any person coming into contact with it.
- Engineering controls, being physical controls that reduce the risk.
- Administrative controls, being safe work procedures, training, supervision and the like.
- Personal protective equipment.
Substitution, isolation and engineering sit at the same level
Substitution, isolation and engineering controls sit at the same level. The regulation asks you to apply one or more of them, not to work down them in turn.
This is where the New Zealand hierarchy differs from the strict ladder used in a lot of overseas material, and it matters on a real job. If isolating a hazard is reasonably practicable, you do not have to demonstrate that substitution was considered and rejected first. The three are alternatives at the same rank, and a combination is often better than any one of them.
What is ranked is what comes after. Administrative controls sit below those three, and personal protective equipment sits below administrative controls.
Where PPE belongs
WorkSafe is direct about this: “PPE should only be used when other control measures alone cannot adequately eliminate or minimise risks.” It adds that “PPE should not be the first or only control measure considered, and we expect PCBUs to give preference to other control measures that protect multiple at-risk workers at once.”
That last clause is the reasoning, not just the rule. A guard rail protects everyone who walks past it. A harness protects the person wearing it, correctly, that day. Higher-order controls work on the workplace; PPE works on one worker at a time and depends on them.
How the hierarchy shows in a Task Analysis
A control column reading “wear PPE, take care, be aware of surroundings” tells a site manager that the hierarchy was never applied. The document is the record of the thinking: what the hazard is, whether it could be removed, and if not, which of the five was chosen and why.
Two practical tests when you are completing one. Could a person still be hurt if they did everything the control says? If yes, the control is probably administrative and you need something above it. And is the control something a person can check on site, such as the edge protection being installed or the board being locked and tagged? “Take care” cannot be checked, so it is not a control.
Sources
- Health and Safety at Work Act 2015, s30 (hierarchy of duties: eliminate, then minimise).
- Health and Safety at Work (General Risk and Workplace Management) Regulations 2016, reg 5 (managing risks) and reg 6 (hierarchy of control measures).
- WorkSafe New Zealand, General risk and workplace management, on personal protective equipment.
This guide summarises the law as at the review date above. It is not legal advice, and it does not replace reading the regulation.