Using a sample of bank-years from 2005 to 2017, we examine the effect of internal control quality on future risk-taking and performance. We find that banks that disclose a material weakness in internal controls have higher risk-taking and worse performance in the future, including having a higher (lower) likelihood of experiencing large losses (gains). These findings suggest that weak controls increase (reduce) downside (upside) risk-taking or conversely that strong controls increase (reduce) upside (downside) risk-taking. Path analyses suggest that 22.3 to 43.7 percent of the effect of internal control quality on future performance is through risk-taking. Additionally, material weaknesses are negatively associated with total asset, loan, interest income, and non-interest income growth, suggesting that internal control quality affects both core and non-core activities of banks. Overall, results suggest that strong internal controls improve bank risk-taking, in part through asymmetrically reducing downside risk-taking while facilitating upside risk-taking, ultimately improving bank performance.