The hierarchy is not a menu
The order of controls is fixed: eliminate the hazard; if you cannot, substitute something less hazardous; if you cannot, apply an engineering control; then an administrative one; and last, personal protective equipment. Article 5 of Law 6331 sets out the same order in its principles of prevention: combat risk at source, replace the hazardous with the non-hazardous or less hazardous, and give collective protective measures priority over individual ones.
What makes the difference is dependence
An extraction system takes the dust at source, and it does so whoever is on shift that day. A mask protects only if it is on, if it is the right size, if the filter has not expired, and if a beard is not breaking the seal. An engineering control is a property of the system; PPE is a property of the moment.
Last resort does not mean “no resort”
The hierarchy does not belittle PPE; it places it. For residual risk that cannot be resolved at source, PPE is mandatory, and for some tasks it is the only realistic protection. What is wrong is jumping straight to the fifth step without trying the first four, and then writing “control applied” in the risk assessment.
What the record should show
Where PPE is entered as a control, the record should also say why the higher steps could not be applied. Without that sentence, the question waiting in an inspection — and after an accident — is the same one: why was this not solved at source?