You did not mention important information in your question:
- In which sector of the market you work
- Whether your company is publicly traded in the US stock market
- Whether your company handles government contracts or is in an regulated industry such as banking (Gramm-Leach Biley) or healthcare (HIPPA).
The answers to these questions matter. If your company is publicly traded in the US, then it is subject to the Sarbanes Oxley (SOX) law, and specific sections, namely section 404 mandates personal responsibility for senior management in establishing internal controls over financial reporting.
While no specific internal controls are listed in the SOX law, business processes that impact the integrity of financial reporting of a company are becoming more and more integrated with IT. Hence inadequate IT security / controls in your company is no longer just an IT security problem, but a business problem, which costs the firm money. Senior management in the past have had gone to jail for false attestation under SOX.
Even if the the SOX law does not apply in the case your company is privately held, such practices are still extremely ill-advised from both a business and IT security perspective. Consider implications of what your company's current practice mean in questions below.
- As accounts are shared and everyone knows the common default
password, individual accountability (non-repudiation) is lost.
How can you trust approvals on any important business documents if the you / the company can't be certain the documentation is actually from the person who the message states it is from?
If your company were to be audited, how will your guarantee a clean
audit trail that is not compromised? Audit logs become meaningless in
such a situation, negating individual responsibility
How do you know that an intruder is not on your company network? Can you really be sure the person who an email for example, is actually a legitimate individual and not someone malicious, especially in the case of remote users?
Finally, you can let management know that current practice exposes themselves to risk. They can no longer deny individual responsibility if something were to break, as accounts are shared. Rational management should be able to realize that by stopping such practice, it serves their own best interests.
If your management insists in keeping the policy as is, the best bet is to establish frequent audits of such computers and a "designated owner within IT" to be held responsible for accounts and password management. Management should decide and document its decisions in a policy on how shared accounts can be used such as which users are authorized to use your particular account to logon. Read this article from SANS for detailed best practices around shared accounts that can help you in your discussion with management.