Nobody ever got in trouble for the simulation that had signed approval. People have absolutely got in trouble for the clever one they ran on their own initiative. This page covers the document that protects the programme, the staff and you - before a single fake email exists.
A phishing simulation is, on paper, an IT person sending deceptive email to colleagues. The only thing that makes that sentence describe training instead of misconduct is documented authorisation. Getting it is one short meeting and one page of writing - and it decides every hard question in advance, while everyone is calm.
Platforms are exciting and paperwork is not, so teams build first and ask later. That order is backwards for one practical reason: the questions the approval answers - who is included, what the page may record, who sees results, what happens to repeat clickers - are design inputs. A campaign built before they are answered has to be rebuilt, or worse, defended. Sign first, and every later decision is just following the document.
The approval is one event; a line in your security awareness or acceptable use policy makes it permanent: the company runs periodic simulated phishing exercises for training, participation carries no disciplinary consequence, and results are reported in aggregate. New joiners meet that line at induction, so nobody is ever tested before they were told testing exists. If your office has no such policy yet, this approval document is the honest place to start one.
Sooner or later a clicked employee will feel embarrassed and complain - that is normal and expected. The complaint lands very differently when the answer is a signed programme with stated rules than when the answer is improvisation. Show the document, show the teaching page, show the no-punishment line, and route the coaching privately. Programmes die from one mishandled complaint far more often than from low click rates.
See how the video sets up the simulation side once the programme paperwork is in place.
▶️ Watch Full VideoNo. A verbal yes evaporates the first time someone complains. One page with the purpose, audience, window, hard rules and signatures takes ten minutes and protects everyone - including the boss.
Only the programme owner, and only to arrange private coaching. Leadership receives totals and trends. The moment a name list circulates, staff stop reporting real suspicious mail - the exact opposite of the programme's goal.
One approval can cover a year's programme of quarterly campaigns inside the stated rules. A campaign that steps outside them - a harsher lure, a new audience, any change to what is recorded - needs fresh sign-off first.