PPE Is the Last Line of Defence: What Australian Small Businesses Get Wrong About Personal Protective Equipment
- OHS News
- 18 hours ago
- 7 min read
Handing a worker a pair of gloves and calling it a day is not risk management. It might feel like it. It’s cheap, it’s quick, and it gives everyone the impression that safety has been considered. But under Australian WHS law, reaching for PPE before working through the other options isn’t just a shortcut. It’s a failure to follow the hierarchy of controls.
This post covers what the hierarchy actually requires, where PPE fits within it, what your obligations are when you do use PPE, and how to manage it properly without drowning in paperwork.
What is the hierarchy of controls?
The hierarchy of controls is the framework Australian WHS law uses to manage risk. It’s not a suggestion. Under the model WHS Act and Regulations, a PCBU (that’s a person conducting a business or undertaking, essentially anyone running a business) must work through the hierarchy in order before deciding how to manage a hazard.
The six levels, from most effective to least effective, are:
Eliminate the hazard entirely. Remove the task, the substance, or the situation that creates the risk. This is the most effective option because it removes the risk at the source.
Substitute the hazard with something less dangerous. Replace the chemical with a safer one, use a lower-risk process, choose a different material.
Isolate the hazard from workers. Physical separation: barriers, enclosures, exclusion zones, remote operation.
Engineering controls. Physical changes to the workplace, equipment or process: guards, ventilation systems, noise enclosures, dust extraction.
Administrative controls. Changes to how work is done: safe work procedures, job rotation, training and supervision, scheduling hazardous tasks when fewer workers are present.
PPE. Personal protective equipment: gloves, helmets, eye protection, hearing protection, respiratory protection, high-visibility clothing.
PPE sits at the bottom. It’s the last control you apply, not the first one you reach for.
The reason is straightforward. Every control above PPE reduces or removes the risk itself. PPE doesn’t touch the hazard at all. It just puts a barrier between the hazard and the person. That means the hazard is still there, it still needs to be managed, and if the PPE fails (or the worker uses it incorrectly, or forgets it, or it doesn’t fit properly), there is nothing else between the worker and the risk.
Why so many businesses get this wrong
Most small businesses aren’t ignoring the hierarchy on purpose. They just haven’t been taught it properly. The PPE option is visible, tangible and cheap. A hard hat on a shelf is easier to point to than a noise enclosure or a revised work procedure.
The result is that businesses end up using PPE as a first-line response when it’s meant to be a last resort. A cleaning business hands out chemical gloves without asking whether the chemical can be substituted for a less hazardous product. A manufacturer issues ear protection without investigating whether the noisy machine can be enclosed or isolated. A tradie passes out knee pads without checking whether the task can be redesigned to reduce manual kneeling.
None of that is illegal on its own. But if you are required to use PPE and you haven’t genuinely considered and ruled out higher-order controls first, you are not meeting your obligations under WHS law.
When is PPE the right answer?
PPE is appropriate in two situations:
As a residual control. You’ve worked through the hierarchy, applied what is reasonably practicable at each level, and some residual risk remains. PPE addresses what’s left. This is the correct use, and it’s common. Most workplaces end up using some level of PPE because not all risk can be eliminated or fully engineered away.
As a temporary measure. While you’re implementing higher-order controls, PPE can bridge the gap. It’s not the solution, but it’s appropriate as a short-term measure while permanent controls are put in place.
What PPE is not appropriate for is as a substitute for thinking. If you haven’t genuinely worked through the hierarchy, issuing PPE is compliance theatre. It looks like safety. It isn’t.
What the law actually says: your obligations as a PCBU
Under the model WHS Regulations, specifically Regulations 36, 44 and 45, when PPE is used in a workplace, the PCBU has a specific set of obligations. These aren’t optional extras. They are legal duties.
You must provide PPE at no cost to workers. This catches a lot of businesses out. If you direct workers to use PPE, the cost is yours. You cannot charge workers for it, deduct it from wages, or ask them to supply their own. This obligation comes from section 273 of the WHS Act, and it applies whether you are an employer, a principal contractor directing subcontractors, or any other form of PCBU.
The PPE must be suitable. That means suitable for the specific task and the specific hazard, not just any glove or any helmet. It must protect against the actual risk present.
It must fit properly. A helmet that doesn’t sit correctly, or gloves that are two sizes too large, are not meeting the standard. Under Regulation 44(3), the PPE must be a suitable size and fit, and reasonably comfortable for the worker wearing it. If it isn’t comfortable or doesn’t fit, you’re required to help the worker fix the problem.
It must be maintained. PPE that is worn out, damaged, or contaminated must be repaired or replaced. The obligation extends to ensuring the equipment remains effective over time, not just at the point of issue.
You must provide training and instruction. Issuing PPE without training is not sufficient. Workers must receive information, training and instruction on how to use it correctly, how to wear it, how to store it, and how to maintain it. That training needs to happen before the worker uses the PPE, not after.
Workers also have their own obligations under Regulation 46. They must use or wear PPE correctly, in accordance with any training or instruction provided. They must not intentionally misuse or damage it, and they must report any damage or defect to a responsible person.
Real scenarios: what this looks like in practice
On a construction site. A worker laying a residential driveway uses knee pads during concrete finishing. Before issuing them, the question is whether the task can be redesigned to reduce the kneeling component. On a job this size, that may not be reasonably practicable. So the knee pads are the right answer here, as a residual control. The PCBU must provide them at no cost, ensure they fit, and make sure the worker knows how to use and maintain them.
In a commercial cleaning business. A cleaning worker uses a spray chemical product on floors. The first question is whether the chemical can be substituted for a less hazardous product. If yes, that’s the right call. If a substitute isn’t available or practicable, engineering controls (forced ventilation, automatic dispensing) should be considered. Administrative controls (limiting exposure time, task rotation) come next. Chemical-resistant gloves and eye protection come after all of that.
In a small manufacturing workshop. Noise from a press is a known hazard. Before issuing hearing protection, the question is whether the press can be enclosed, isolated, or fitted with noise reduction. If the noise level can’t be brought below the exposure standard through engineering means alone, hearing protection is appropriate as a residual control. But it should sit on top of engineering controls, not instead of them.
The most common misconception: “We’ve got PPE covered”
Here’s what “we’ve got PPE covered” usually means: there are gloves and helmets in a cupboard, workers know where they are, and everyone more or less uses them on the job.
That is not a PPE system. It is a drawer full of equipment.
A PPE system means you can show:
what hazards exist in your workplace and why PPE was selected as the control (or part of the control) for each
that higher-order controls were considered for each hazard
that the PPE selected is appropriate for the specific task and hazard
that each worker was issued PPE, received training on its correct use, and that this is documented
that the PPE is maintained and replaced as needed
Without documentation, you can’t demonstrate any of this if a regulator asks, or if something goes wrong and the question is asked: “What controls did you have in place?”
A PPE issue register is the minimum. It doesn’t need to be complex. It needs to record who was issued what, when, and that they received adequate training.
How this connects to your WHS Management System
PPE management doesn’t sit in isolation. It connects directly to your risk assessment process (where you identify hazards and work through the hierarchy), your safe work procedures (which specify which controls apply to which tasks), and your training records (which document that workers have been trained in the controls relevant to their work).
Your procedure for PPE in your WHS Management System should covers the full PPE obligation: selection, issue, training, maintenance and record-keeping (i.e. a PPE issue register that documents what’s been provided to each worker and confirms training has been given). It’s the kind of thing that takes five minutes to complete and can make a significant difference if your workplace is ever audited or investigated.
Three action steps
Audit your current PPE use against the hierarchy. For each hazard where you’re currently using PPE as a control, ask whether higher-order controls have genuinely been considered and ruled out. If the answer is “we just always used gloves/helmets/ear muffs for that,” that’s worth revisiting.
Check that PPE issued is fit for purpose and properly documented. Suitable for the hazard. Right size and fit for each worker. In good condition. And recorded. If you can’t produce a record showing who was issued what and that they received training, that’s a gap.
Start a PPE register. Download the free PPE Register for Employees below and use it. It’s a simple, practical starting point. Fill it in for each worker, attach it to their training record, and keep it with your other WHS documentation.
About Everything OHS
Everything OHS has been helping small Australian businesses get their WHS documentation right since 2008. More than 12,000 businesses have trusted us for industry-specific, expert-made WHS documents, one-off cost, no subscription, fully editable and aligned to Australian regulations.
Comments