We agree with your internal auditors that your direct deposit ACH authorization forms should include information on revoking an authorization. That said, it is up to you to determine the method by which your employees should revoke (or change) their authorizations. The NACHA rules require that every ACH authorization include language stating that “the Receiver may revoke the authorization only by notifying the Originator in the time and manner stated in the authorization.” Section 2.3., Subsection 2.3.2.3(c). However, note that authorizations for credit entries into consumer accounts need not be in writing. Section 2.3, Subsection 2.3.2.1.