A Certification Body Can Assess Competence Without Authorizing Practice

The spreadsheet says credential_status = current.

Everyone exhales.

The person has passed an exam.

There is a badge.

There is a post-nominal.

Somebody has uploaded a PDF with a tasteful seal in the corner.

Your talent system has found the string and turned it green.

Then your staffing manager asks whether that person may perform the regulated work on Monday.

And the room discovers that current is not a legal status.

It is a word.

Possibly a very well-maintained word.

Still a word.

A certification body can assess competence. A licensing authority can authorize practice.

Those two decisions may use similar ingredients.

Education.

An examination.

An application.

A renewal cycle.

Continuing learning.

A register.

They are not the same decision.

They draw authority from different places and attach to different scopes.

The durable thing beneath both is competence: whether a person can perform a defined job, role, function, or task with the required judgment under stated conditions.

The wrapper is the scheme.

Or the licence.

Or the certificate.

Or the extremely reassuring row in your HRIS called credential_name, where the jurisdiction has been omitted because there was only room for one text field.

That omission is manageable right up until it becomes a deployment decision.

The exam is not the licence

Physical therapy supplies the kind of example that makes this less philosophical.

The National Physical Therapy Examination is an assessment.

That is the whole of what it is.

It runs 225 multiple-choice questions in a five-hour block.

180 are scored.

45 are unscored pre-test items used for psychometric calibration.

Scores run from 200 to 800.

The passing scaled score is 600.

That is a serious assessment process, built against a fixed competence standard rather than a curve. A candidate who falls short gets a diagnostic report, waits, and works against a lifetime cap on attempts.

None of that assigns a licence number.

The state board does that, afterwards, through the administrative gates: primary-source transcripts, criminal-history clearance, the examination result, a local jurisprudence requirement, and final adjudication under delegated statutory authority.

The licence then appears in the board’s public registry, with a name, a number, an issue date, an expiry date, and a disciplinary standing.

The difference is not ceremonial.

One body assessed evidence.

The other made a legal authorization decision for a jurisdiction.

This is also why a common examination does not make a common regulator. The Next Generation NCLEX is shared licensing-examination infrastructure across state, territorial and certain Canadian jurisdictions. Every individual board still retains authorization to test, endorsement, discipline, and the final licensure decision.

Same examination family.

Different legal act.

Regulation has a proper job

It is tempting to file the licence as an old-fashioned credential with worse user experience.

That would be a category error, though possibly a popular one at the vendor demonstration.

Licensing regimes are created by practice acts.

The statute gives jurisdiction to a named board, defines the boundaries of a profession, and can supply two separate controls.

Title protection restricts who may use a protected professional designation.

Practice exclusivity restricts who may perform defined services for compensation.

Those are different instruments.

If you model only titles, you can miss whether someone is permitted to do the work. If you model only an exam pass, you miss both.

Licences are also conditional over time.

Issuance starts a renewal cycle, with continuing competence requirements, attestations and audits attached to it.

So a certificate can be valid while a licence is expired.

A licence can be active while a specialty certification has lapsed.

Two green cells.

Two different things.

Certification has a proper job too

None of this is an argument against certification bodies.

They solve a real problem.

They turn a competence claim into a checkable signal, so that you do not have to reconstruct a career from a folder called final_portfolio_v3_REVISED.pdf.

ABMS makes the boundary usefully visible.

It is an umbrella for 24 member specialty boards. The member boards set specialty eligibility and assessment requirements; ABMS supplies the cross-board frame.

And initial board certification requires the physician to already hold a current, unrestricted medical licence.

Read that requirement again.

It is the whole argument in one clause.

Specialty certification is not a substitute for permission to practise medicine. It is a further judgment, made on top of one.

That extra signal has real value.

Continuing certification covers professionalism, lifelong learning, assessment and improvement, with the member boards choosing the activities. A serious scheme keeps practice expectations current without taking over the state’s licensing role.

The same restraint shows up downstream.

ABMS says specialty certification should not be the sole determinant of clinical privileges.

A hospital’s privileging decision.

An insurer’s panel decision.

A board’s licensure decision.

A specialty board’s certification decision.

Four institutions.

One practitioner.

Four different questions.

This is not bureaucracy reproducing for sport.

It is several different questions refusing to pretend they are one question.

What a trustworthy certification record actually holds

The name of a credential is not the record.

It is the label on the record.

Start with the issuer.

You want the legal entity name, the jurisdiction, the organizational form, the authority to issue, the scheme owner, and the scheme scope.

ISO/IEC 17024 defines that last one as the specific job, role, or function the certified person can perform competently.

Which is doing considerable work.

“Certified” is not a scope.

“Current” is not a scope.

“Widely respected” is definitely not a scope, although it survives many steering committees.

Then the governance trail, which has to tell you who approved the scheme, who set eligibility, who set the passing standard, who issued or denied, who hears appeals, and who withdraws. ISO/IEC 17024 keeps the certification decision, impartiality management and organizational structure separate.

The same cheerful box on an org chart should not quietly perform all three.

Candidate status needs its own states, too: eligible, assessed, certified, maintained, revoked.

Passing an exam occupies exactly one of them.

PMI’s handbook illustrates why.

Its process can involve review of education and experience, a panel review for some credentials, an examination, and continuing professional development for maintenance.

That is a credible certification process.

It is not a law authorizing anyone to undertake regulated work in every place a project happens to be located.

The assessment evidence needs more than a logo and a promise of rigour.

Purpose.

Intended population.

Evidence type.

Content blueprint.

Delivery mode.

Scoring method.

Pass standard.

Accommodations.

Security controls.

Score reporting.

The Standards for Educational and Psychological Testing organise the same concerns across validity, reliability, fairness, development, cut scores, administration, reporting and rights.

That is what makes a claim about assessment inspectable by you, rather than only by the people who were in the room.

And the job or practice analysis is the provenance artefact underneath all of it. NCCA calls it the foundation of a credentialing program.

A published content outline may be transparent.

It is not, by itself, evidence that the outline still describes current practice.

Oversight is not issuance either

There is one more familiar trap, and it usually involves an accreditation logo placed with great enthusiasm beside a certificate.

NCCA reviews a program’s documented conformity against its standards.

Process, policy, scoring, administration, program quality, maintenance.

It does not decide that a particular candidate passed.

It does not interpret an eligibility policy for that candidate.

It does not grant anyone legal authority to practise.

ANAB likewise operates an ISO/IEC 17024 accreditation pathway in the United States and lists personnel certification bodies in a directory. Its name does not issue every certificate displayed by a provider.

Accreditation attaches to a program and a scope, with dates, status and conditions. So record the accreditor, the standard, the covered scheme, the effective and expiry dates, the status, the conditions, and the logo-use authority.

A brochure image is not current proof.

In March 2026, ISO/IEC 17024:2026 replaced the 2012 edition. A system that stores “ISO accredited” without the scope, the edition and the current status has preserved the confidence and discarded the evidence.

AI does not understand a post-nominal by looking harder at it

Credentials emerged in schemes.

Licences emerged in jurisdictions.

Examinations emerged in testing systems.

Then workforce platforms imported all three and asked a model to match people to high-stakes work.

The model sees a shared acronym, an exam name, or letters after a name.

It normalizes them into one elegant token.

The token lands in an authorization field, because the data model called every external achievement a credential.

Congratulations.

The machine has converted similarity into permission.

NBME is a useful correction.

It develops assessments and co-sponsors the USMLE with the Federation of State Medical Boards, with more than 350 health professionals on its test-development committees each year.

That supports an assessment-development claim.

It does not make NBME the state medical board that licenses a physician, or a specialty certifier.

Your system has to model that distinction before a model can preserve it.

So keep legal authority, issuing body, assessment provider, scheme owner, jurisdiction, scope, credential status, licence status, effective date, expiry date, verification source and evidence record as separate fields.

Keep the source document and its date.

And if a directory search comes back negative, do not infer non-certification unless the issuer says its directory is complete, current, and searchable by the identifier you actually have.

This is dull data architecture.

It is also the difference between a system that says “credential present” and a system that says “authorization unverified; check the regulator.”

The second system is less dramatic.

It is much safer to staff from.

Four bodies, four sentences

Certification bodies assess competence.

Regulators authorize practice, where the law assigns them that role.

Accreditation bodies assess programs against their standards.

Assessment developers build and operate sound examinations.

All four are useful.

The failure starts when your workforce system collapses them into a badge with an expiry date.

Keep the durable capability visible.

Keep the scheme wrapper visible.

Keep the jurisdiction visible.

Verify current legal status with the regulator, and current credential status with the scheme owner.

Then a person can hold a meaningful certification without your system inventing a licence.

Which is a modest improvement.

But Monday’s staffing decision is usually made from a modest improvement.