We are an OCC bank with assets < $1 billion but occassionally we outsource internal audit procedures due to staffing resources or to use an external firms expertise. During a recent OCC exam, our OCC exam team has stated that in this situation, I should be writing the workprogram, determining sample sizes, reviewing all workpapers and if not detailed or sufficient testing, require additional work or documenation. Have other banks had this same critique?
In some cases, i.e. technical IS scanning, firewall review, etc. I do not have the expertise to make these judgements. In this case, do we hire someone else to check these?

In reading your comment I think the OCC has gone to far. The outsourced firm should be providing the Bank with an engagement letter and procedures to be performed. The you and the Audit Committee should be reviewing the procedures to be performed and determining if this is meets your expectations. As far as reviewing workpapers, this will not happen. The workpapers are not yours.

We in the past have received copies of Workpapers and was asked to provide them to the OCC.

As far as writing the workprogram, determining sample sizes I am surprised that they did not expect you to conduct the testing as well. Yes over the line.

One thing to consider, maybe the examiners are not comfortable with the firm doing the internal audit work or not able to get a handle on procedures performed from the reports.

I sign off on each set of procedures prior to our firm doing an "internal audit" for me. I do the annual risk assessment. I do not review any work papers or determine sample size. I do have the ability to ask for "more" if there is an area of concern. The only criticism I've received was that the final reports (electronic and paper at the time) came directly to me...the OCC thought I could change a finding (nope, I'm too lazy). So now, the reports are all electronic and are delivered to me and our audit committee chair.

The OCC does go to their location and review workpapers for a few sample audits.

Your independent auditor should determine the audit parameters during the initial audit risk assessment. Our Audit & Compliance Committee does review work papers and testing procedures to ensure that the auditors followed their procedures.

I require copies of workpapers in our engagement letter. The OCC reviews them electronically and has not had an issue with the testing.

The issue the OCC had was that the universe and sample sizes were not included in the audit report. We spoke with our external auditor and this is now included in our reports.