You might want to ask your lawyer what duties you assume to enforce a policy when you make one.
What I mean is this.
Let's say you don't have a policy regarding concealed firearms by your employees and one of them shoots the first customer into your store on July 1. That customer's family sues you for something or other. Ask your lawyer whether that suit is likely to be for negligence: you had a duty and did not meet it. But what duty did you have? Are all employers required to frisk all employees throughout the day? Do employers issue CWPs or is that the state's responsibility? What, in other words, did you do wrong if you don't have a policy and one of your employees does wrong?
Now let's say you do have such a policy and one of your employees shoots that customer. Having made the policy, haven't you assumed the duty to ensure that your employees comply with it? How will you police your employees to make sure that they do?
If you have the policy but do not police your employees, and everybody sort of just winks at each other with the unspoken agreement that it's okay as long as they don't get caught, is there a plaintiff's lawyer in this country stupid enough to not demonstrate that you have assumed a duty and then breached the duty you assumed? Will you be lucky enough to be sued by that one stupid, incompetent plaintiff's lawyer?