Security – Remove local accounts but leave domain accounts in local administrators

First, DON'T capitulate. He is not only an idiot but DANGEROUSLY wrong. In fact, releasing this information would violate the PCI standard (which is what I'm assuming the audit is for since it's a payment processor) along with every other standard out there and just plain common sense. It would also expose your company to all sorts of liabilities.

The next thing I would do is send an email to your boss saying he needs to get corporate counsel involved to determine the legal exposure the company would be facing by proceeding with this action.

This last bit is up to you, but I would contact VISA with this information and get his PCI auditor status pulled.

What are the pros and cons of keeping such local (non-domain) admin accounts on domain-joined workstations in respect to:

Security

There's little difference. An account with administrative privileges can destroy a machine. This is true whether we're talking about a domain or local account. Some would argue that the local Administrator account is more vulnerable to attack simply because it's a well-known username. If that's a concern, you can always change the account's username with a GPP although this doesn't mitigate attacks that rely on the account's well-known SID, which cannot be changed. IMHO it's more important to use a strong password than try to evade unwanted logon attempts.

One noteworthy difference unique to the local administrator account is that by default it automatically bypasses UAC. This is meaningless if an attacker is logged in; UAC won't stop him. However, UAC can be useful to help protect a legitimate admin. This behavior can be changed through GP eliminating it as a difference.

Management

Local accounts are harder to manage. And not just the local Administrator account. Changing a domain account is easily done in one place, affecting all computers where the account is used. A local account can only be modified on the workstation where it exists. However, with the advent of Group Policy Preferences, some local account changes (e.g. renaming the local Administrator to something else [see above]) can be managed with Group Policy. There are also utilities available for changing local account passwords.

Data Access/Problem Solving

A local administrator account is indispensable. Only the previous 10 domain accounts to successfully logon a machine can still logon in the event connectivity to a DC is lost (this number is configurable). If none of these accounts have local admin privileges and you're troubleshooting a machine that can't establish a network connection, you're stuck. Even access to the Recovery Console won't be possible (at least without hacks). But with an available local Administrator account, you never have to worry about this happening. For this reason alone I have a local admin account on all domain machines I manage, including (especially) servers.