You can't mitigate all risk, so it's a question of how much can reasonably be tolerated. No corporation allocates capex to defend against a meteor hit on its corporate headquarters. In like fashion, I'm sure that BP did not plan to prevent an oil spill on the scale of what occurred, on the rationale that nothing like that has ever happened before. We thought that the financial industry is the only area where Black Swan Events can arise. Not so - any complex enterprise can have them too.
The Black Swan swam into BP's waters. BP never saw it coming.