Accept only if the appetite is copied from a comparable organisation.

Accept, 

because

internal audit's risk-based role includes ownership of risk appetite and

responses.

Explain 

that

management and the board retain decision-making responsibility, while internal

audit may evaluate the process and provide objective advice and assurance.

Decline 

all involvement, because internal audit may not provide

advice on risk management.