An IS auditor is reviewing an outsourcing arrangement in which a cloud provider hosts a critical customer-facing application. The signed contract specifies a 99.9% monthly availability target and defines financial service credits payable to the organization if the target is missed. During the review, the auditor notes that the organization relies entirely on the provider's self-reported availability figures and receives only a quarterly summary report. Which of the following is the auditor's GREATEST concern?