This is a good write-up from one of the major phishing vendors discussing what to do when individuals fail internal phishing tests.
Brian Krebs is an independent, security-focused reporter. He is often first to report on complex, previously unknown scams.
Question: Does the City of Portland perform internal phishing tests? Yes we do.