What industry are you in? Giving everyone admin rights is definitely not "best practices", and consequently you could find your company falling short of meeting security requirements laid out in HIPAA, Sarbanes-Oxley, etc.
Your biggest issues will probably be spyware/malware related. The complications from that would run from system performance issues and downtime all the way up to security breaches, along with theft or destruction of confidential or customer data.
Where I used to work we originally deployed all of our PCs with nobody having admin rights. After awhile a vendor provided application came around that required local admin rights to function correctly. To accommodate them we gave a subset of our users full admin rights on their PCs. This affected roughly 100 of our 350 PCs deployed. Not long afterwards we found ourselves having to rebuild and redeploy 1-2 PCs a week due to users installing spyware/malware/software that shouldn't be installed, or wasting time troubleshooting "strange performance issues."
I went back to the vendor and insisted that we had to have a way to run the programs without full admin rights, and we came up with a solution that included modifying permissions on the install directories and application-specific registry keys. Once those changes were deployed we locked down the PCs again, and we had a dramatic reduction in the number of rebuilds/fixes that we had to do every week.
There is no doubt that allowing the users to have full admin rights resulted in a definite cost for the company in the form of increased IT workload which caused other IT assignments to fall behind schedule. Not to mention just the stress of having to constantly redeploy the same systems over and over again. Once we had security back where I wanted it there was a positive impact, both financially and in stress levels. And while my users were never happy that they couldn't install the latest dancing pigs screensaver, they had a lot less downtime to deal with when things were done "the right way."
But the bigger issue I think is with your management. If the person in question is an IT manager/director, then they very clearly have no idea what they're doing and shouldn't be in the job. If they're not an IT manager/director, then they very clearly have no business making decisions about routine IT security issues because they don't understand the implications. The equivalent would be me telling the finance people that we need to switch from cost-based accounting to accrual-based accounting (or vice versa). It's not my area of expertise or responsibility (or the manager's). I suspect that this is just the tip of the iceberg to come, too...
