An IS auditor finds that the organization is still running a critical financial reporting application on an operating system that reached end-of-life two years ago and no longer receives security patches. Management's position is that the application is firewalled off and 'low risk.' The MOST appropriate audit observation is: