My understanding is that you multiply the cost by the probability, or use a power of the cost (since the impact of a huge liability or disabling disaster is usually more than the accounted-for direct damage).
Problem is that it's virtually impossible to estimate the probability of a black-swan event, since, by definition, they are events that have never happened before and nobody has foreseen them possibly happening. A priori, your probability is zero, and yet they happen anyway.
We can be fairly certain that something unexpected will happen in the future, but predicting what that something is or with what likelihood it will occur is still the domain of fortune-tellers.
Do we do that for various financial endeavors and shut them down due to the economic risk posed? Cost of 9/11 was rather large, but it was not that large simply due to terrorism, it was that large due to the failure of various measures meant to prevent it... all aligning into a perfect storm.
And therein lies the problem. How do you calculate the probability in the first place? For some things (asteroids) this is possible, for others (catastrophic rapid climate change or terrorism) we don't have the predictive tools.
We can be fairly certain that something unexpected will happen in the future, but predicting what that something is or with what likelihood it will occur is still the domain of fortune-tellers.