I recently discovered that a large swath of the finance department is using Excel to connect to my SQL Server 2000 instance with an account in the sysadmin role. What are my current risks that I should immediately communicate to the powers that be?
Pretty much everything.
I'd start with their potential ability to use
sp_configure if they can't, so then they can ... and whatever the account returned by
xp_cmdshell 'whoami.exe' can do....), then move onto their ability to do
Further risks include not just finance users being able to do these things, but any program on a finance machine gaining access to your sysadmin connection credentials...
(Other potential risks include the risk of discovering that one of TPTB set it up this way)
One thing that the financial people should understand is that by giving the Excel the system user, you have bypassed every internal control built into the database or the application. A competent auditor would eviscerate them for this. So for instance if you have controls built to ensure that two different people must approve an expense (to avoid potential fraud) then by connecting the Excel spreadsheet this way, you have removed this control on the data completely.
If a malicious user destroyed your data, you could restore from backup--you should be able to calculate the impact to business for this scenario.
What may be worse is that your system no longer has integrity. If a user manipulates data in a non-catastrophic way, you may not discover the damage until after your backups are no longer an available option. Consider the impact of the business being unable to trust the validity of any data housed on that server.