Yes, you are correct, the audit system is exploitable. You can indeed visit the question by clicking the link (or even clicking the question title). And by doing that you'll never fail any audit, ever.
It is not a problem at all because the audit system was not designed to catch the reviewers that are prepared to visit every question from an review to verify the correct action required.
Worst what will happen, I think, is that those users will gain badge while being poor reviewers.
Let's take a step back and try to solve the issue.
We want to design an audit system that is unexploitable. I see some options:
- We could disable the links on the page that let you visit the post
This would indeed make it harder to exploit the 2 audits on every 50 reviews but it would also make the life of the reviewers during legit reviewing extremely misserable
- We use fake questions for audits
This would make it harder to exploit but if the search enginge doesn't find the question it probably is an audit so still exploitable. Creating such audit might be more difficult than the automated proccess it currently is so we might have scaling issues with this as well.
- We could keep track if a user visits a question currently locked for them in the queue.
This could be an option with a price for the hardware and resources needed but still not failsafe. With a second account, second IP still an exploit is possible. And legit users that want to take extra action on a question (voting, editing, answering, commenting, delete voting etc) are directly impacted by this.
What really remains is the question if the audit system was and is designed to be non exploitable? And the answer to that is no. There are users and by defintion that is not you nor me, nor all users that participated in this question, that don't care about audits and simple click looks good / no action needed. Mindless reviewers. For those users the audit system does its job. They are stopped and now and then one is brave (or not smart) enough to come to meta and complain about a failed audit. And now and then a high-rep, involved user gets tricked by an audit.
As long as reviewing doesn't give you more than a few badges it is not a big deal. As soon as reputation can be gained this way we are in a different ball-park.
And to be clear: We need people who want to review and moderate those queues. If you make the life miserable of the sheer amount of users that take on this task day after day because you implement features to catch a few robots that get a badge by cheating I would say development resources are focused on the wrong group.
Related posts:
- Easy to bypass “Are You paying Attention” test by viewing question in detail
- Bring a “human factor” into review audit composition/selection
- Are the suggested edit audits too easy?
- Showing votes on review audit questions
- Audits bug in the filtered review queue