A lot of people complain that certifications demonstrate a familiarity with a Common Body of Knowledge (CBK), but that a familiarity with the knowledge does not indicate competence at applying it. In an attempt to compensate for this, some authorities have required proof of experience and professional endorsements. But, sadly, experience is not the same as competence.
Some have suggested that certification should be accompanied by monitored internships or with specific project work in order to prove competence.
But these are all missing something of the point. CBKs are good at informing a practice, but they can't teach professionals how specifically to implement a practice. Companies are too diverse. What works for a bank isn't guaranteed to work for a hospital. What works for a risk-centric security department isn't guaranteed to work for a response-mandated organization. Success implementing a risk management program in a healthcare organization is not a guarantee of success doing the same on a government contract.
CBKs define the points at which differing organizations converge, not the techniques specific individuals must use to apply the knowledge successfully in different circumstances.