It is a great step but it’s rare to have enough buy in from upper managent to enforce any real consequences for repeat offenders. I’ve seen good initial results from this kind of phishing testing, but the repeat offenders never seem to change their habits and your click rate quickly plateaus.
Stay suspicious. As a security guy, i’d way rather respond to 1,000 false positive reports than have an employee that doesn’t think about it and just clicks.