OTTAWA, Ontario—To ensure there are no gaps in an organization's catastrophe risk management program, it first must define what constitutes a catastrophe for the business, according to one risk management expert.

Speaking Tuesday at the annual RIMS Canada Conference in Ottawa, Ontario, Mark Aiello, vp and practice leader of the risk strategies assessment team at Marsh Risk Consulting in Toronto, used the Deepwater Horizon oil rig disaster as an example, noting that the event affected various organizations differently.

Ultimately, the disaster may cost energy company BP P.L.C. $42 billion, Mr. Aiello noted.

Within two months of the April 2010 explosion and fire that destroyed the rig, killed 11 and allowed nearly 5 million barrels of oil to pour into the Gulf of Mexico, BP's stock price had dropped 55%.

But, “By the end of BP's fiscal year, they were paying dividends again to their shareholders,” Mr. Aiello said. In the fourth quarter, “they were reporting a profit.”

“While the risk from a global perspective may have been defined as a catastrophic, from BP's perspective it wasn't catastrophic,” he said.

However, the event would surely qualify as a catastrophe for a small charter fishing company on Florida's Gulf Coast that was put out of business by the oil spill, Mr. Aiello said.

“Catastrophic risk has to be defined differently for every organization,” he said. “It’s really something that puts the viability of an organization at risk.”

In order to define what qualifies as catastrophic, an organization must decide how big a loss it can afford, Mr. Aiello said.

“Catastrophic risks tend to be low-likelihood events,” Mr. Aiello said. “So the lower the likelihood, the fewer data points that you have.”

But just because an organization’s experience is catastrophe-free doesn’t mean it has no catastrophic exposures. “It just means that nothing’s happened to you yet,” he said.

Mr. Aiello outlined an approach to measuring catastrophic exposures that he described as a “progressively narrowing process” that begins with identifying critical processes within the organization. Next, he said, develop credible scenarios and then develop an “impact pathway”—a stepwise approach to follow interrelated impacts—followed by assigning values to the potential impact on the organization.

Ultimately, Mr. Aiello said, “It’s really important to remember you can’t manage the risk directly. You manage the drivers of those risks, the root causes of those risks.”