This is a good write-up from one of the major phishing vendors discussing what to do when individuals fail internal phishing tests.

Brian Krebs is an independent, security-focused reporter. He is often first to report on complex, previously unknown scams.

https://krebsonsecurity.com/2019/05/should-failing-phish-tests-be-a-fireable-offense/

Question: Does the City of Portland perform internal phishing tests? Yes we do.