Is there any regulatory requirement for a OCC supervised bank to have a Physical Security Policy approved by the Board of Directors? Or could it just be approved by a committee of the board of Directors and senior management as long as the Board approves annually a security officer?

Generally the board approves policy, but that isn't always the case. It can easily be a committee of the board which represents the board. While its been quite some time since I reviewed exam workpapers, I see no reason a committee of teh board couldn't represent "the board."