Dear Aron,
as my point of you is not a best practice. but i do agree it's done in common practice. URS is intended to capture around a business process all regulatory and criticla business needs to perform their business without focus on "a specific system" where the FS comes with a system solution to address some of those needs whereas other URS will be address by process or manual mitigation controls. if we mix both there is a risk to omit some requirements from process view and to focus on operating software capabilities.