Excessive (substantially above peer) litigation against a bank is indicative of operational risk because it often suggests failure to maintain a strong system of internal control. We examine the relation between bank performance and weak internal control using legal expense as a proxy. We find that legal expense is a strong determinant of loan losses and stock returns. Bank regulators should require reporting of legal expense on call reports to help identify institutions with weaknesses in internal control. Current reporting creates unnecessary information asymmetries because investors are not well informed about operational risk, leading to mispricing of bank securities.