Before I get to the meat of my answer down below, I think it's important to make a distinction that you should never ever under any circumstances delete a user account.
First and foremost, it's because deleting the account risks removing the historical audit log / record of that account's activity. You should immediately disable the user account and ensure it is unable to actively login or perform any activities anywhere on the network. This is true whether terminating an employee or after an employee voluntarily leaves, but you should never delete a user account, under any circumstances.
Doing so may actually be a violation of the law in certain jurisdictions if the employee was terminated, and even if not, at the very least, deleting the account and the associated historical record of that account's activity may put your firm at a distinct disadvantage if you ever have to defend your actions in a lawsuit.
Now to the more detailed answer....
I would say that it fundamentally boils down to "the principle of least privilege"
As US-CERT puts it:
Only the minimum necessary rights should be assigned to a subject that
requests access to a resource and should be in effect for the shortest
duration necessary (remember to relinquish privileges). Granting
permissions to a user beyond the scope of the necessary rights of an
action can allow that user to obtain or change information in unwanted
ways. Therefore, careful delegation of access rights can limit
attackers from damaging a system.
By definition of a user who is no longer employed with the company should have zero privileges since they have no legitimate function to do anything at the company with any resources.
Wikipedia provides a nice definition and an extensive breakdown of the benefits and advantages of adopting this fundamental first principle of information security:
In information security, computer science, and other fields, the
principle of least privilege (also known as the principle of minimal
privilege or the principle of least authority) requires that in a
particular abstraction layer of a computing environment, every module
(such as a process, a user, or a program, depending on the subject)
must be able to access only the information and resources that are
necessary for its legitimate purpose.
When applied to users, the terms least user access or -privileged user
account (LUA) are also used, referring to the concept that all user
accounts at all times should run with as few privileges as possible,
and also launch applications with as few privileges as possible.
The principle of least privilege is widely recognized as an important
design consideration in enhancing the protection of data and
functionality from faults (fault tolerance) and malicious behavior
Benefits of the principle include:
Better system stability. When code is limited in the scope of changes it can make to a system, it is easier to test its possible
actions and interactions with other applications. In practice for
example, applications running with restricted rights will not have
access to perform operations that could crash a machine, or adversely
affect other applications running on the same system.
Better system security. When code is limited in the system-wide actions it may perform, vulnerabilities in one application cannot be
used to exploit the rest of the machine. For example, Microsoft states
“Running in standard user mode gives customers increased protection
against inadvertent system-level damage caused by "shatter attacks"
and malware, such as root kits, spyware, and undetectable viruses”.
Ease of deployment. In general, the fewer privileges an application requires the easier it is to deploy within a larger
environment. This usually results from the first two benefits,
applications that install device drivers or require elevated security
privileges typically have additional steps involved in their
deployment. For example, on Windows a solution with no device drivers
can be run directly with no installation, while device drivers must be
installed separately using the Windows installer service in > order to grant the driver elevated privileges.
NIST goes further with specific process suggestions and justifications for each, though they largely echo the sentiments described earlier:
Least privilege refers to the security objective of granting users
only those accesses they need to perform their official duties. Data
entry clerks, for example, may not have any need to run analysis
reports of their database.
Friendly Termination. Friendly terminations should be accomplished by implementing a standard set of procedures for outgoing or
transferring employees. This normally includes:
removal of access privileges, computer accounts, authentication tokens,
the control of keys,
the briefing on the continuing responsibilities for confidentiality and privacy,
return of property, and
- continued availability of data. In both the manual and the electronic worlds, this may involve documenting procedures or filing
schemes, such as how documents are stored on the hard disk, and how
are they backed up. Employees should be instructed whether or not to
"clean up" their PC before leaving. If cryptography is used to protect
data, the availability of cryptographic keys to management personnel
must be ensured.
Unfriendly Termination. Given the potential for adverse consequences, organizations should do the following:
System access should be terminated as quickly as possible when an employee is leaving a position under less than friendly terms. If
employees are to be fired, system access should be removed at the same
time (or just before) the employees are notified of their dismissal.
When an employee notifies an organization of a resignation and it can be reasonably expected that it is on unfriendly terms, system
access should be immediately terminated.
- During the "notice of termination" period, it may be necessary to assign the individual to a restricted area and function. This may be
particularly true for employees capable of changing programs or
modifying the system or applications.
In some cases, physical removal from the offices may be necessary.