That depends on the type of transaction, and the type of account it posted to (consumer or non-consumer).
For a simple return (no such account, NSF), you need to return it the next business day, just like you would do if it were a check being returned for similar reasons.
There are a number of different ACH standard entry classes that, when the receiving account is a consumer account, an unauthorized ACH debit can be returned for an extended period. These have to reach the ODFI by the first banking day after the 60th calendar day from the settlement date of the transaction being returned.
Anything older than that, and you may still be able to make a claim against the ODFI and Originator for breach of their warranties that the transaction was authorized.