Hello,
The WLC is the one that define the timeout. By default it is 2 seconds but you can modify, I suggest to use 10 seconds.
If the authentication packet will take more than 10 seconds to reach the ACS, will be a good idea to install an ACS locally on each site.
Hope this helps.
Erick Delgado
Cisco CSE