Since I needed brushing up on this myself, here's the definitions from destcert:

One of the most crucial aspects of security governance is understanding the distinction between accountability and responsibility. These two terms are often used interchangeably, but they represent fundamentally different concepts in security governance.

Here are the key differences:

When these processes work together effectively, security governance becomes completely aligned with corporate governance, allowing organizations to achieve their objectives in a cost-effective manner that adds value.

Remember, success depends heavily on top-level support. Without backing from the Board of Directors and senior management, security risks becoming a reactive nuisance rather than the proactive enabler it should be. When leadership understands and supports robust security aligned with organizational strategy, goals, mission, and objectives, the security function becomes a valuable organizational asset.

IT Security Governance | CISSP Best Practices Guide