In a study that took nearly two years to complete, the Securities and Exchange Commission concluded what CFOs at small, publicly traded companies have suspected for years: they’ll have to pay a disproportionately higher amount to comply with the internal-controls portions of the Sarbanes-Oxley Act than larger companies.

“Although larger companies incur higher compliance costs, smaller companies incur higher scaled costs (i.e., relative to their assets) on average,” the SEC wrote in a report released Friday.

What may come as a surprise is that the majority of Sarbox-compliance costs aren’t going into auditors’ pockets; rather, companies’ in-house work to follow the 2002 law’s internal-controls provision — Section 404 — is more largely to blame for the expense. The highest cost of Sarbox, the SEC said, is “internal labor costs,” followed by audit fees and then costs related to another third party, such as a consultancy, used for help with compliance.

The SEC concluded that companies paid a mean total of $2.87 million when they first began following Sarbox, and expect to pay a mean cost of $2.03 million for their next internal-controls report. The commission believes that over time, the expense of complying has decreased as companies got more used to following the rules and as the regulators tweaked them. The regulatory changes cut the amount of work companies and their auditors are expected to do, according to the commission.

Drilling down further, the SEC found that companies reported they expect to spend a mean of $1.2 million in internal-controls costs for the next fiscal year. And the commission figures the audits of their internal controls will cost a mean of $583,753 in fees.

There’s an assumption that smaller companies will have a similar experience — meaning their cost of complying will go down over time — and possibly even more so now that they have received their fourth extension of the deadline for compliance with 404(b), the requirement that a company’s auditors must affirm management’s assessment of the company’s internal controls. Plus, they already have one year of experience doing the management assessment.

Small companies’ perceived cost burden is important because it’s caused a series of delays in the deadline for full Sarbox compliance. The SEC has been dogged by small-business advocates wanting extensions to Sarbox since soon after the regulator first estimated that compliance would cost firms an average of $91,000. In late 2007, under pressure from members of Congress who called for specific cost-benefit dollar figures, then–SEC chairman Christopher Cox responded with the promise of the type of study that was completed Friday.

Indeed, the SEC issued its fourth reprieve for small companies on Friday when it issued its cost-benefit study. But SEC chair Mary Schapiro warned that it would be the last. “Since there will be no further Commission extensions, it is important for all public companies and their auditors to act with deliberate speed to move toward full Section 404 compliance,” she said in a statement.

While the largest of U.S. publicly traded companies are in their fifth year of compliance with Section 404, nonaccelerated filers — those with a market cap below $75 million — have yet to fully comply. It was only last year that they began filing management’s assessments of internal controls with their 10-Ks.

These companies would have had to begin getting their auditors’ signoff on their internal controls for annual reports filed for fiscal years after December 15, 2009, but the SEC has given them another six months. Now, the new deadline is for fiscal years ending on or after June 15, 2010. Protiviti, a consultancy, notes that the delay gives some companies — those with a fiscal year ending between December 15 and June 14 — an extra year to comply. But it will have no effect on companies whose fiscal year ends between June 15 and December 14.

Not surprisingly, the commission study implied that the benefits of Sarbox outweigh the expense. The 2,907 companies — half of which were large filers — that responded to the SEC’s Web survey between last December and January 2009 were more likely to report that Sarbox has so-called direct benefits such as improved financial reporting than indirect consequences such as a better ability to raise capital. All publicly traded companies that had gone through a 404(b) attestation report were invited to respond to the survey.

The SEC’s conclusion was based on a $121-per-hour salary, derived from a 2008 salary report by the Securities Industry and Financial Markets Association. The commission gave many caveats to its estimates; among them, the difficulty in verifying the survey respondents’ listed audit fees, both because auditors don’t tend to break out costs by task and because internal labor costs vary by company. Further, Sarbox costs vary by company size and by how long a company has been subject to Sarbox rules.

In the report, the SEC patted itself on the back for changing how companies and their auditors first complied with Section 404. Total costs have declined for companies since that time, according to the report.

Not all the findings support the pro-Sarbox tone of the SEC report. Among the more negative conclusions: only 40% of respondents thought Sarbox boosted their confidence in other companies’ financial reports, and most said 404 hasn’t raised investor confidence in either the reports or the overall value of their firms.