My opinion is that these tests are not to test competence, but to mitigate risk by transferring that risk elsewhere. Kind of a version of the 'No one ever got f

My opinion is that these tests are not to test competence, but to mitigate risk by transferring that risk elsewhere. Kind of a version of the 'No one ever got fired for buying IBM'. If you give a user sudo privileges, and then they don't know what they're doing so they rm -rf or worse, then management puts you squarely to blame. If the user has a cert you can point to, and regs that say users with that cert may get sudo privileges, then you can point to the regs and the cert so that now the certifying organization is to blame. Or more likely the user will be blamed, malice will assumed instead of ignorance. Which brings to mind Bear's rule 11 (I'm Bear): Never attribute to malice, without investigation, what you can attribute to ignorance, as ignorance is common and malice is not.