The requirements are, but enforcement isn't always particularly strong. There's a LOT of companies using SR&ED and relatively not a lot of bureaucrats checking up on it. It's extremely valuable to a company, so some will go to some pretty ridiculous lengths to get it.