That's a tough one. I can think of several, but they would only apply to my company. Find out what they've been putting off doing and work on that.
One thing that always needs done. Find the users who have elevated permissions - such as db_owner on a production box. Get hold of them and get justification of why they need the privileges. Create a document of why people need the privileges they have and which ones are no longer needed and can be removed.
-SQLBill