As a fellow information security professional with similar duties working as an IT auditor, I feel your pain. :) Our work is not "popular" in a company for a reason, due to our responsibility to protect assets, and monitor security compliance. Great job for recognizing the risk, albeit how unlikely, that any insider can have malicious intent and are a potential threat to security.
You absolutely cannot back down when confronted if you are to remain effective in doing your job. Security risks are not something management or senior employees is ordinarily willing to talk about. So first learn to accept a certain amount of conflict is inherent in the nature of your job.
Having said that, the preliminary list given by @dlb is a good start. From that list, you can derive some inherent risks inherent to privileged Admin role. Its pretty easy to list some and how he can hide his actions:
The risk to Confidentiality of data leakage
The insider Admin copies some sensitive financial data and electronically sends it out of the company to himself or a competitor. Competitive intelligence is lost, and the economic value of the lost data can be significant, maybe even business survival relevant.
The risk to Integrity of unauthorized data deletion
The Admin decides to erase some data used in the database or otherwise tamper with stored data. Now data integrity has been compromised and the resulting potentially false financial reporting can lead to huge regulatory fines.
The risk to Availability through various methods of DOS / DDOS
Applications used by financial companies are often time sensitive, fr example to capture accounting transactions, or to process extremely time sensitive asset trades on the market. A attack that result in loss of ability of legitimate users and / customers to access the application is a loss because of opportunity cost of the extra time required to process the original work.
Example of how the insider admin can hide his actions
- Erase or tamper with audit logs recording his activity
- Disable or tamper with any application alerting functionality that may be in place
Making management aware of the difference between inherent risk, the security risks present before any safeguards are implemented and residual risk, the security risk that remains after safeguards (technical, administrative, and / or physical) is implemented is my first suggestion to you. Use specific, concrete examples of inherent risks and the associated impact, similar to examples given here.
Without security safeguards in place, any of the risks identified in the preceding paragraph can easily impact this financial system resulting in loss to the company. This bring me to my second suggestion - educate management and other non security savvy folks, how safeguards such as DLP can be used to mitigate security risks. As an example:
Through DLP implementation we reduce our risk of sensitive data
exfiltration.
When explaining or suggesting new security controls to be implemented, cite your research to show why implementing this particular control / process will improve cybersecurity - think CIA here. Refer to best practices using sources such as NIST, SANS etc. This shows that your recommendations are not arbitrary but based on solid reasoning. Also, it is important to stress you and your team are not there to make anyone's job harder, but to partner with them in improving operational security. Show how having good security practices will benefit the company - improved customer confidence, less downtime etc.
Finally, IT security is about risk and the acceptance or mitigation of such risk. It may be that your management has a large security risk appetite, and is willing to accept security risks surrounding this application. Alternatively, the control environment / tone at the top at the company, may be lax. I.e: management may be pushing back because they simply don't care. Think of the control environment (or the lack thereof) at companies such as Enron, WorldCom, Tyco..
In either of the above cases, you may have to accept your ability to initiate change is limited by company culture and operating philosophy. If management of the company is comfortable in not taking action to remediate the vulnerabilities you find, you should document your communication to them to evidence that you did you due diligence. Nevertheless what management of your company chooses to do, as IT security professionals, we have done our job. Sometimes, giving a warning is all you can do/
If you really want to show your management the potential costs of not remediating a security vulnerability discovered by you, you may have to show them what may happen when such vulnerabilities are exploited by threat agents such as disgruntled insiders , competitors, etc. Examples such this one or these ones should be pretty illustrative.