password policy with regard to application userid

[u.bodalina () gmail com]

What would be a reasonable password policy with regard to userids used in applications?
For example Business Objects needs a system level userid to intergrate with active directory. What would the security 
implications be if this userid's password wasn't changed? 
Standard users follow a policy in which they have to  change their password every two months.
Thanks