348. Competent authorities should determine additional own funds requirements, covering:
a. the risk of unexpected losses, and of expected losses insufficiently covered by provisions, over a 12-month period (except where otherwise specified in Regulation (EU) 575/2013) ('unexpected losses');
b. the risk of underestimation of risk due to model deficiencies as assessed in the context of Article 101 of Directive 2013/36/EU; and
c. the risk arising from deficiencies in internal governance, including internal control, arrangements and other deficiencies.