Not specifically addressing the mall posting issue, I think the signs would cover the building also, but to the comments regarding the business owners accepting responsibility for your safety if they have chosen to post their business with no gun signs.
This falls under the "Duty of Care" of federal tort (civil) law. There are several criteria that must be met before a duty of care is established and it goes state by state pretty much. Here is the legal definition.
a duty of care is a legal obligation imposed on an individual requiring that they adhere to a standard of reasonable care while performing any acts that could foreseeably harm others. It is the first element that must be established to proceed with an action in negligence. The claimant must be able to show a duty of care imposed by law which the defendant has breached.
This is the first question asked.
"Was the act that took place foreseeable?". Most cases of mass shootings in churches, schools, spa's and so on don't really lend themselves to meet this criteria unless the bad guy sends a letter of intent with a date of his action there is no way the business could know what was going to happen.
Keep in mind that there is no study, statistic or anything else that shows businesses posted with no gun signs are anymore likely to be the scene/victim of a violent act than a business that welcomes firearms.
There are also some states that use a multi-factor system to determine this. The first was in 1968 and looked like this.
the foreseeability of harm to the injured party;
the degree of certainty he or she suffered injury;
the closeness of the connection between the defendant’s conduct and the injury suffered;
the moral blame attached to the defendant’s conduct;
the policy of preventing future harm;
the extent of the burden to the defendant and the consequences to the community of imposing a duty of care with resulting liability for breach;
and the availability, cost, and prevalence of insurance for the risk involved.[6
A 1997 case added to this:
the social utility of the defendant's conduct from which the injury arose.[7]
Most states have followed California in implementing some kind of multi-factor analysis. Some states simply copied California's factors but modified them, like Michigan (which deleted the insurance factor and never picked up the social utility factor),[8] while others developed different lists of factors, such as this one from Tennessee:
the foreseeability of the harm or injury;
the possible magnitude of the potential harm or injury;
the importance or social value of the activity engaged in by the defendant;
the usefulness of the conduct to the defendant;
the feasibility of alternative conduct;
the costs and burdens associated with the alternative conduct;
the relative usefulness of the alternative conduct;
and the relative safety of the alternative conduct.[9]
Once it is determined that a duty of care was established then it must be proven that they then breached it.
Breach involves testing the defendant's actions against the standard of a reasonable person, which varies depending on the facts of the case. For example, physicians will be held to reasonable standards for members of their profession, rather than those of the general public, in negligence actions for medical malpractice.
In turn, once the appropriate standard has been found, the breach is proven when the plaintiff shows that the defendant's conduct fell below or did not reach the relevant standard of reasonable care.
However, it is possible that the defendant took every possible precaution and exceeded what would have been done by any reasonable person, yet the plaintiff was injured. If that is the case, the plaintiff cannot recover in negligence.
So it is not as simple as it seems. A duty of care has to be established, then you have to prove that the duty of care was breached or did not meet standards and even then it is subjected to the reasonable man criteria.
I am not claiming to be a legal eagle nor did I stay at a Holiday Inn Express last night I simply like to read and expand my knowledge base. Besides that it is Eid's a Muslim holiday so the bad guys have stood down and the internet is working good so I am taking advantage of it.
Information added. Here is what I found on Wisconsin Duty of Care.
101.11 Employer's duty to furnish safe employment and place.
(1) Every employer shall furnish employment which shall be safe for the employees therein and shall furnish a place of employment which shall be safe for employees therein and for frequenters thereof and shall furnish and use safety devices and safeguards, and shall adopt and use methods and processes reasonably adequate to render such employment and places of employment safe, and shall do every other thing reasonably necessary to protect the life, health, safety, and welfare of such employees and frequenters. Every employer and every owner of a place of employment or a public building now or hereafter constructed shall so construct, repair or maintain such place of employment or public building as to render the same safe.
(2)
(a) No employer shall require, permit or suffer any employee to go or be in any employment or place of employment which is not safe, and no such employer shall fail to furnish, provide and use safety devices and safeguards, or fail to adopt and use methods and processes reasonably adequate to render such employment and place of employment safe, and no such employer shall fail or neglect to do every other thing reasonably necessary to protect the life, health, safety or welfare of such employees and frequenters; and no employer or owner, or other person shall hereafter construct or occupy or maintain any place of employment, or public building, that is not safe, nor prepare plans which shall fail to provide for making the same safe.
(b) No employee shall remove, displace, damage, destroy or carry off any safety device or safeguard furnished and provided for use in any employment or place of employment, nor interfere in any way with the use thereof by any other person, nor shall any such employee interfere with the use of any method or process adopted for the protection of any employee in such employment or place of employment or frequenter of such place of employment, nor fail or neglect to do every other thing reasonably necessary to protect the life, health, safety or welfare of such employees or frequenters.
(3) This section applies to community-based residential facilities as defined in s. 50.01 (1g).
It basically comes down to a reasonable effort on the part of the employer/business to prevent injury. Can you stretch that into a business can foresee and armed attack? Probably not but who knows.