AI and the Hierarchy of Controls: Prioritize Your Highest-Risk Hazards

The Spreadsheet Problem No One Talks About

If you've managed an EHS program for more than six months, you know what hazard prioritization actually looks like in practice. It's a spreadsheet — usually inherited from whoever had the job before you — with columns for hazard description, likelihood, severity, and a risk score that someone calculated manually, probably two years ago. Half the rows haven't been touched since the last audit. A few of them reference equipment that's been decommissioned. One of them is just labeled "misc. chemical storage" with no further detail.

You're expected to use that document to make decisions about where to spend your limited budget, which corrective actions to push first, and which hazards to bring to leadership. The hierarchy of controls — elimination, substitution, engineering controls, administrative controls, PPE — gives you a clear framework for how to address hazards. What it doesn't give you is a reliable way to figure out which hazards to address first, especially when you're looking at 200 line items and one FTE.

This is where safety programs quietly fail. Not because the people running them don't care — they do — but because the manual approach to hazard prioritization doesn't scale, doesn't update in real time, and is only as good as the last person who touched the spreadsheet.

What the Standard Actually Requires

OSHA's General Industry standards don't prescribe a single hazard prioritization methodology, but the underlying obligation is clear. Under 29 CFR 1910.132(d), employers must assess the workplace to determine if hazards are present and select appropriate controls. OSHA's Recommended Practices for Safety and Health Programs — while not a regulatory citation, they're referenced in enforcement context — explicitly call for a hazard ranking process that accounts for both severity and likelihood.

In process safety contexts, 29 CFR 1910.119 requires process hazard analyses with documented findings and recommendations, along with a system to track resolution. The intent is the same whether you're in general industry or PSM-covered operations: hazards should be ranked, the highest risks should drive the fastest action, and the hierarchy of controls should guide your response. The compliance requirement isn't just to identify hazards — it's to prioritize and act on them in a defensible order.

Most safety managers assume that as long as they have a hazard register, they're meeting this obligation. The reality is that an outdated, manually maintained register with no clear prioritization logic is difficult to defend in an inspection, and nearly impossible to act on efficiently.

How Gerty Handles Hazard Prioritization

Gerty approaches the hierarchy of controls as a data problem, not a documentation problem. Here's what that looks like in practice:

• Ingestion and normalization: Gerty pulls in data from your existing sources — incident reports, near-miss logs, inspection findings, corrective action records, and equipment maintenance histories. It normalizes inconsistent language across those sources so that "slip hazard," "wet floor incident," and "slip/trip/fall" are recognized as the same category.
• Risk scoring with ML weighting: Rather than a static likelihood-times-severity matrix, Gerty applies machine learning to weight each hazard based on historical incident frequency in your specific facility, industry benchmarking data, and unresolved repeat findings. A hazard that has generated three near-misses in six months ranks higher than a hazard of similar theoretical severity that has never been triggered.
• Hierarchy of controls mapping: For each prioritized hazard, Gerty suggests where on the hierarchy an effective control sits — flagging, for example, when a program is relying on PPE (the bottom of the hierarchy) for a hazard where engineering controls have been documented as feasible in your own past corrective actions.
• Real-time reprioritization: When a new incident is logged or a corrective action is closed — or missed — Gerty updates the risk rankings automatically. Your Safety Manager or EHS Coordinator sees a live list, not a snapshot from Q2.
• Audit trail generation: Every prioritization decision is logged with the data inputs that drove it, giving you a defensible record for OSHA inspections or internal audits.

A Concrete Scenario

A manufacturing facility's EHS Coordinator is preparing for a quarterly safety review. Their hazard register has 180 items. Manually, sorting those by risk score, checking which corrective actions are overdue, and identifying which controls are still relying on administrative procedures rather than engineering solutions would take the better part of a day — and that's assuming the register is current, which it usually isn't.

With Gerty, the coordinator opens the dashboard and sees the top 15 hazards ranked by dynamic risk score, with flags indicating which ones have open corrective actions past due and which ones are currently controlled only by PPE or administrative procedures despite engineering solutions being documented as available. The quarterly review prep time drops from a full day to under an hour. More importantly, the coordinator walks into that meeting with a prioritized list they can defend with data, not just judgment.

What Gerty Doesn't Replace

This matters, so it's worth being direct about it.

Gerty does not replace the judgment of a qualified safety professional. Machine learning can surface patterns in your data that a human might miss across 180 line items — but it cannot walk your facility floor, smell a chemical that shouldn't be there, or recognize that a machine guard looks compliant on paper but has been zip-tied in place by a frustrated operator. Physical walkthroughs by a competent person — as required under standards like 29 CFR 1910.217 for mechanical power presses — are irreplaceable.

Gerty also does not make control decisions for you. It can flag that your current control for a forklift pedestrian hazard sits at the PPE level when barriers and traffic segregation are documented options. The decision to implement those engineering controls — the budget conversation, the operational tradeoffs, the timeline — belongs to your EHS team and operations leadership.

Think of Gerty as the analyst that makes sure nothing falls through the cracks and that your prioritization logic is consistent. The expertise that acts on that analysis is still yours.

Frequently Asked Questions

Can Gerty work with our existing hazard register format?

Yes. Gerty is built to ingest data from common EHS management formats, including CSV exports, spreadsheets, and integrations with platforms like Intelex and Cority. Your existing data doesn't need to be perfectly structured — normalization is part of what Gerty handles on ingestion.

How does Gerty handle hazards that have never resulted in an incident?

Gerty uses industry benchmarking data alongside your facility-specific history, so hazards with low local incident frequency but high industry severity rates are still surfaced appropriately. A low local incident count doesn't mean a hazard is low risk — it may mean you've been fortunate.

Does Gerty generate documentation we can show to OSHA?

Gerty maintains a timestamped audit trail of hazard rankings, data inputs, and corrective action status. That record is exportable and is designed to support compliance documentation requirements under standards including 29 CFR 1910.119 and general hazard assessment obligations under 29 CFR 1910.132(d).

What size operation is Gerty designed for?

Gerty scales from single-site operations to multi-site enterprises. The prioritization logic is most impactful for programs managing more than 50 active hazard line items, where manual sorting becomes genuinely unmanageable — but smaller programs benefit from the consistency and audit trail even at lower volumes.

Does Gerty replace our EHS software platform?

No. Gerty is an AI compliance automation layer that works alongside your existing EHS infrastructure. It adds machine learning-driven prioritization and real-time risk scoring to data you're already collecting — it doesn't require you to replace your current system of record.

The Bottom Line

The hierarchy of controls is one of the most useful frameworks in safety management. But a framework is only as good as the information you feed into it. If your hazard prioritization is built on a static spreadsheet updated quarterly by whoever has time, your highest-risk hazards are not reliably at the top of your list — and you probably can't prove they are.

Gerty fixes the data problem so the framework can actually do its job. Your safety team's expertise handles the rest.

Start a free Gerty trial and see what your hazard register looks like when the prioritization is driven by your actual data — not the last person who touched the spreadsheet.