In order to have a "true" revoked authorization of a recurring ACH debit do we need the actual correspondence from the customer to the business or will just a statement from the customer saying they have revoked the authorization work?

In what context - to stop further transactions?

The commentary to 1005.10(c) states that you "may" require proof that the merchant was notified.

Revocation of authorization. Once a financial institution has been notified that the consumer's authorization is no longer valid, it must block all future payments for the particular debit transmitted by the designated payee-originator. But see comment 10(c)-3. The institution may not wait for the payee-originator to terminate the automatic debits. The institution may confirm that the consumer has informed the payee-originator of the revocation (for example, by requiring a copy of the consumer's revocation as written confirmation to be provided within 14 days of an oral notification). If the institution does not receive the required written confirmation within the 14-day period, it may honor subsequent debits to the account.

Operationally speaking, since you are not required to obtain confirmation of the cancelled authorization, it makes more sense to accept the WSUD, return the items and let the merchant deal with your customer. You don't have a dog in this fight, so move on to what's next.

Thanks for your response.