You have two basic things you need to address:
1) Do you meet the current best practices for Information Security in your organization?
There are several good resources including the Microsoft Security Baseline Analyzer, and using resources such as NIST and SANS.
If your organization is large enough for an AD environment, they likely need and should have insurance in case of data loss. Most insurance agencies require a certain baseline otherwise your SOL at claims time and good luck with litigation.
Back to litigation, piss poor standards also set your organization up for negligence lawsuits from multiple sources. E.G Employee, Customers, Venders, etc. If the C-Level was made aware, did nothing, and tried to blame you or your team, you'd also have wrongful termination suit, etc.
2) What are your risks?
Information Security is very much like financial risks, you need to understand your goals, what's acceptable to your organization, and what you need to reduce. We tend to look at this through quantitative and qualitative risk.
To be frank, C-Levels don't really care about a specific attack being averted, they care about specific risk being reduced to manageable levels. For instance, you don't tell the CEO that you improved security by requiring and only using Third Party SSL certificates from verisign or wherever. You tell them you have reduced the risk of MITM attack and implemented policies to manage the risk. The third party certificates are quantitative representation of that risk and your servers which use it are its exposure.
BTW, this not trying to skirt around an issue or that your C-Level is to dense to understand SSL/TLS. It's communicating to them in the language they are familiar with and any good business person deals in risk.
For your particular example, making permissions easier is a technical function to reducing what risk:
- reducing provision issues which expose additional risk?
- exposing privileged information to unauthorized users?
- all of it?
These are the items they want to hear about, what changes you make are your data for reducing that risk, also this is an extremely simplified way of looking at this.