The first lesson is that industry and government must both stop managing risk by catastrophe.

Why must any lessons be learned and paradigms changed only after utter catastrophe?

After Exxon Valdez we decided double hulled tankers and a clean- up fund were the thing for oil spills. Now we discover redundant blow out protection in deep sea drilling is desperately desirable and no clean-up fund is adequate.

Management by Catastrophe never works to mitigate true risk and is thus doomed to long-term failure.

Management by catastrophe fits a standard story arc. Disaster is followed by changes in process, design and attitude, followed by a period of success in risk abatement, followed by a plateau period of complacency coupled with a change in key people from the ones who lived the disaster to those who only have heard about it. Since nothing is going wrong, the new generation decides investment in maintaining vigilance against disaster is excessive and after cuts in risk control resources and acceptance of bigger risk appetites, eventually and tragically, disaster hits again.

Crucially, Management by Disaster gets both government and industry stuck in the zero sum game of how much government regulation is necessary to prevent industry generated disasters versus how much free enterprise can handle the risks on its own. The raw wounds of a disaster push well meaning and highly intelligent people into non-productive fights over how much and what kind of government based regulation, inspection and enforcement are required to mitigate corporate generated risk, versus allowing corporations the luxury of defining how they themselves will mitigate catastrophic risk.

It is especially unfortunate that right now, and for the foreseeable future, it is a one-sided fight. In the U.S., industry will always get the luxury of defining its own risk mitigation strategies. And it is not because government based regulation is both generally unpopular (unless in the wake of disaster), and government actions are usually fraught with a clear lack of effectiveness.

It is because we never learn the second lesson that we should be learning from disasters like the BP blowout. In the name of Free Enterprise, we allow corporations the luxury of mitigating risk on their own terms without the most effective safeguard: unlimited indemnification. The United States has never learned that when we allow industry to make a profit from public lands and seas we must utilize the simple and basic principle of 100% risk transfer.

If the United States public and our environment are being placed at risk by an industrial operation, then this risk needs to be 100% transferred to those who are profiting from the risky operation. If, as we now do, we allow industry to externalize risk, then we are subsidizing greed, incompetence and failure leading to catastrophe for our environment and our citizens.

What does this latest BP incident tell us about our current paradigm of externalized industry risks? In this specific case, the oil disaster could have perhaps been averted if BP’s blowout protection device was functional. The point is not arguing over the details of the blowout preventers but to ask the key question: why didn’t BP think functional blowout protection was worth it?

BP’s own 2009 environmental impact report for this production site went on the premise that a major oil spill was unlikely. Their leadership still, most damningly, insists that the disaster was “unforeseeable.” Perhaps they can get away with that because here in the U.S., corporations such as BP or Massey mining exist in a protective cocoon of taxpayer sponsored externalization of risk, they don’t really feel the urgent need to protect both the entire company and our public lands and seas and population from their cavalier failure to install functional blow out protection and manage a risk that devastates far beyond the reaches of the corporate headquarters and their punctured stock price.

It all comes down to indemnity. Here in my city, if any private sector company wants to use city property for a private sector purpose, I make sure they are contractually bound to hold the City harmless for the full costs and losses they can generate before they are allowed to move an inch. The lesson to be learned is to scale this concept up to protect us at the federal level.

BP claims it will pay “legitimate costs,” for the disaster that is corporate-speak for “here come the lawyers to shield the company from paying anything.” If it ends up, as with Exxon, that BP pays only pennies on the dollar for the full costs of their disaster, what are we going to do about it? If BP and its cohorts in this environmental crime do not pay for the full and true cost, including all the “indirect costs” we are shielding them from the actual risk of their actions by allowing them to externalize the true cost of a global disaster. This means the taxpayers of this country will be heavily subsidizing BP and cohorts for their incompetence now and far into the future.

When you watch the news reports over the next few months play out with all the frantic and ultimately useless efforts to corral and sop up the residual oil in marshes and bayou, as you watch the arguments over the science and politics of how clean is clean and how much damage to birds, shrimp, oysters, fish and sea mammals has really been done, when you hear all the wrenching stories of all the health effects both physical and mental to the fishermen, the clean-up crews and affected families all around the Gulf Coast, and read those reports on all the small businesses and jobs lost during a period of incredible financial stress, it will be time to think of how much this is really costing us all and how much we are really subsidizing BP’s risky behavior in their quest for profit.

Irrespective of whether you favor heavy regulation of risky industries with strong specification standards or letting industry do it themselves, how can anyone favor continued externalizing the true costs of their actions?

If we do not absolutely create an ironclad liability that corporations must fully and completely hold the U.S. fully harmless for the risks they create while they are making vast profits within our borders, we are subsidizing corporate failure and subsidizing corporate sponsored devastation and companies will never manage catastrophic risks properly. And to those who insist that 100% indemnity will end oil drilling, or coal mining, or any other important activity, I would ask: how much less than 100% liability do you favor for a company like BP in the aftermath of their decade of serial occupational killings and serial environmental disasters? It is a given that many companies will be able to step up and take on full indemnity because they know they can properly manage catastrophic risks and still make a good profit without causing disaster.

Isn’t that what we want, the companies of the highest caliber getting the rewards, not the incompetents?

The lesson learned is that until we stop subsidizing corporate desire to externalize their risks and internalize all their profits, we will continue to destroy people and the environment in a multitude of ways over and over again. Gary Rosenblum is risk manager of City of Palm Desert, Calif.