Administrative controls should be your last resort. In most HIRARC documents across Malaysia, they are the first — and often the only — option considered.
This is not a minor formatting issue. The hierarchy of controls is a fundamental principle in occupational safety and health, and misapplying it produces a risk assessment that looks complete on paper while leaving actual risk largely unaddressed.
What the Hierarchy of Controls Actually Says
The hierarchy of controls Malaysia HSE practitioners reference in HIRARC work has five levels, ordered from most to least effective:
Level 1 — Elimination. Remove the hazard entirely. If the hazard does not exist, it cannot cause harm. This is the most effective control and the one that requires the least ongoing human effort to maintain.
Level 2 — Substitution. Replace the hazardous material, process, or equipment with something that presents a lower risk. Using a water-based cleaning product instead of a solvent, or redesigning a task so it can be done at ground level instead of at height, are substitution controls.
Level 3 — Engineering controls. Physical barriers, machine guarding, interlocking systems, ventilation, pressure relief valves. Engineering controls work by placing a physical system between the hazard and the worker. They do not require the worker to make a decision or take an action — they function independently of human behaviour.
Level 4 — Administrative controls. Standard operating procedures, permits to work, training, supervision, toolbox talks, warning signs. Administrative controls depend entirely on human compliance. They require a person to know what to do, remember to do it, and choose to do it correctly under the actual conditions of the task.
Level 5 — Personal protective equipment (PPE). The last line of defence between a hazard and a person. PPE does not reduce exposure to the hazard — it reduces the severity of harm if the hazard causes contact.
Why the Hierarchy of Controls Malaysia Matters in HIRARC
The hierarchy of controls Malaysia OSH practitioners apply in HIRARC work is not arbitrary. The ranking reflects a practical reality: the higher the control sits in the hierarchy, the less it depends on human behaviour to work.
Engineering controls eliminate the requirement for human decision-making at the point of exposure. A machine guard that physically prevents access to a moving part during operation does not care whether the operator is experienced or fatigued, rushed or distracted. It functions regardless of what the operator decides. This is what makes it more reliable than a procedure that instructs the operator to check clearance before starting the machine.
Administrative controls, by contrast, are entirely dependent on human performance. An SOP works when the worker reads it, remembers it, applies it under actual task conditions, and repeats the process correctly every time across every shift. Each of these steps is a point where failure is possible.
What Most HIRARC Documents Actually Show
A HIRARC review of documents across Malaysian industries — manufacturing, construction, oil and gas, logistics — reveals a consistent pattern: hazards with serious potential consequences controlled entirely by administrative measures.
The typical control column reads: “SOP in place. Training provided. Supervisor to monitor compliance.”
This is three administrative controls. All three depend on human behaviour. All three can fail simultaneously if the supervisor is absent, the training was not retained, and task pressure makes the SOP seem optional. Under the hierarchy of controls Malaysia framework, this level of control is inadequate for a hazard with serious consequence — and yet it passes the HIRARC review because controls have been listed.
The absence of engineering controls for significant hazards is the most common gap that experienced HSE practitioners identify in HIRARC documents. It is also the gap that DOSH investigators focus on when examining whether a company’s risk management system was adequate following a serious incident.
Applying the Hierarchy of Controls in Practice
When reviewing or developing a HIRARC, the question for each hazard should not be “what controls do we have?” but “what controls do we have at each level of the hierarchy?”
For every hazard with a serious or fatal consequence potential, the risk assessment should demonstrate that elimination, substitution, and engineering controls have been considered — and either applied or explicitly ruled out with a documented reason.
Where elimination is not feasible — the hazard is inherent to the operation — the next question is whether substitution reduces the risk. Where substitution is also not applicable, the focus must be on engineering controls before falling back to administrative measures.
Administrative controls and PPE have a role — they fill gaps that engineering controls cannot close, and they provide an additional layer of protection. But they should not be the primary risk control for serious hazards. When they are, the risk assessment has found the easiest answer, not the most effective one.
A HIRARC that has genuinely worked through the hierarchy of controls Malaysia standards will show: attempts at higher-level controls, reasons for moving to lower levels where necessary, and administrative controls and PPE that supplement — not substitute — for engineering measures.
For reference on control hierarchy requirements under Malaysian occupational safety law, the DOSH Malaysia website provides guidance on HIRARC requirements and OSHA 1994 obligations.
Does your team know how to select and justify controls at the right level of the hierarchy? Cikgu Barrier’s Risk Assessment That Works program covers the full HIRARC process — including hierarchy of controls application, control adequacy assessment, and documentation that satisfies DOSH requirements. Contact us to discuss in-house delivery for your team.