What are the risks of changing oracle sys password?
There should not be any problems. Nobody should use this password for application purposes. In case of RAC cluster do not forget to change the password on each node. This password is not stored in the database but in local node's password file.

Unless you use Oracle Data Guard (physical replication). For some reason having the same password on each side is not sufficient and you must copy the amended password file to the other site too.