If you want to know if a sysadmin has enabled SA, I would ensure an audit is in place, with logging to a file. Set permissions for your sysadmin groups (Windows level) and the service account for SQL Server to write only. Set read permissions for the audit groups.