C4.2 Hierarchy of controls

NIOSH / CDC [10]

The second component requires that every control in the register carry its level in the hierarchy, from elimination through substitution, engineering and administrative measures to personal protection, together with a flag for dependence on continued human action and an expected decay profile; and that the aggregation at L3 weight controls by level rather than treat a policy and an automated block as fungible. The source is the occupational-safety hierarchy [10], which chapter 12 described as the single idea finance had never developed because almost everything a bank calls a control sits at the administrative level. The reason the order matters is the one the safety profession learned from injuries: the top three levels act once and keep acting, the bottom two work only while supervisors keep insisting and staff keep complying, and both decay.

The component reconciles two things that the financial sources treat as one. A control self-assessment rates each control on design and operation and sums the ratings; the hierarchy says that the sum is meaningless unless the levels are separated, because thirty administrative controls rated effective describe a process that depends on thirty people doing something every day. The expected decay profile is the framework's addition, drawn from the safety source's observation rather than from any field it publishes: a control at the bottom two levels is re-tested more often and its rating ages, so that a training course assessed as effective in January is not still effective in December without evidence. The five criteria of a robust engineering control that the same source lists, built into the original design, blocking at the source, hard to tamper with, needing minimal user action and not disrupting the work, become the test a control must pass to be recorded at that level.