For accurate timings you also need to take the interrupt latency and the time it takes to actually reload the timer registers into account.
The interrupt fires, then it takes a couple of hundred instructions to do the context saving etc before you actually get to reloading the timer for another 10ms period. If it's used for something like a clock it'll run slow.

What you usually do in the ISR is stop the timer, read it's value, then ADD the reload value (minus a fudge factor to account for the time the timer isn't running) to the value being read from the timer. Then you write the new value back and restart the timer. That way the interrupt latency is always compensated for.

/Henrik.