I will speak directly from experience as an IT auditor / security professional.
How do you keep track of who has access to what?
A good practice is to centralize access by tying all available access to Microsoft Active Directory (AD) for the machines that run Windows. Benefits of approach:
- Centralizes access management using Kerberos built in authentication technology
As soon as the AD account is disabled, any subsequent requests to authenticate from the client to the domain controller via ticket granting ticket(TGT) will fail. This minimizes human error in forgetting to revoke some access.
If your company users SQL server for databases, by setting authentication to Windows mode, as soon as AD is disabled, no access to SQL server and hence database is possible. As a bonus, security risks inherent in SQL Server implementation such as the default SA account is auto-disabled.
To make sure, that the AD account is disabled timely, your mail application can be programmed to auto send a copy of all termination requests to you, minimizing human error of forgetting to revoke access.
- Frees up time for you and your peer IT staff to work on other tasks rather than working on manual access management.
This access monitoring and revocation process should be ongoing, and ideally continuous in a company. From your question, it appears you may be responsible for access provisioning / administration in your role. If true, with management consent, you should be periodically reviewing access and any improper / unauthorized / unaccounted for access discovered should be investigated and / or revoked upon discovery.
How long should you wait until revoking their access?
The answer depends on the type of termination. If the termination is voluntary, a certain latitude such as 1 business day can be used. However if the termination is involuntary, then access should be revoked immediately upon notification of employee by HR / manager. This minimizes the opportunity for a malicious former employee to destroy data, steal IP, or cause other system damage. I will have to respectfully disagree with @David Navarre on this last point. Protecting company assets and minimizing risk should be a topmost priority, rather than protecting the feelings of the employee.
In addition to revoking local access onsite, pay attention to remote access such as VPN. This is critical if the terminated employee has been issued company devices such as a laptop, due to possibility for employee to steal data and sabotage IT resources through creating backdoors, or planting logic bombs. If possible, tie the ability to remote login via VPN to AD as well, so that once AD is cut off, so is all other access that is linked to it. Ultimately your goal is to have the minimum points of access as possible.