Clicking on fishing link is not illegal. Therefore, it is ok for corporate to sent fake fishing emails. This would be instructing employees to do something illegal.

Likewise, CEO can not instruct the accountant to steal money from company account as a test.