Dan Crow is one of the few small-company CFOs with an auditor’s stamp on his internal controls. Getting it wasn’t as time-consuming or as costly as it would have been several years ago, when large public companies first began complying with one of the most onerous requirements of the 2002 Sarbanes-Oxley Act, known as Section 404.

Still, Crow, who oversees finance for retailer Hastings Entertainment, doesn’t rule out dropping the extra review next year if Congress decides to permanently exempt small public companies from needing an auditor’s sign-off on their internal controls — as it seems poised to do. The Senate is expected to vote this week on the final version of the financial regulatory-reform bill, which would exempt companies with public floats below $75 million from complying with Section 404(b), the rule in question. (The House has already passed the bill.)

Crow says a part of him believes that all publicly traded companies should be “on the same page” and subject to the same rules, but another side feels the time and cost of compliance can be burdensome, particularly for smaller companies. “I just wish they would make the decision and stick with it,” he says.

Indeed, regulators and lawmakers have wavered over the years when it comes to Section 404 and small businesses. The Securities and Exchange Commission has issued many delays for companies with public floats below $75 million, or “nonaccelerated filers.” Two years ago, those companies finally had to record their management’s take on their internal controls, but they have repeatedly received a break on getting external auditors to do similar reviews.

The most recent deferral from the SEC, which the commission swore would be the last, means that nonaccelerated filers will have to include a 404(b) report (the auditor’s opinion on internal controls) with their next 10-K, starting for fiscal years ending after June 15, 2010 — unless they get the permanent exemption.

In the meantime, volunteers such as Hastings Entertainment are in the minority. According to research firm Audit Analytics, only 23 companies that characterize themselves as nonaccelerated filers or smaller reporting companies have so far filed a 404(b) report for the 2010 fiscal year. In fiscal 2009, nearly 550 out of the more than 4,100 companies that filed auditor-attestation reports did so on a voluntary basis, according to Audit Analytics.

Larger firms could eventually win a reprieve, too. The reform bill also calls for the SEC to study how the “burden” of 404(b) compliance for companies with market capitalization between $75 million and $250 million could be reduced, and whether an exemption for them could increase the number of initial public offerings in the United States.

Crow says Hastings Entertainment’s internal-control audit cost between $75,000 and $100,000. He believes the cost and time involved in Ernst & Young’s blessing of his internal controls would have been far worse had he had to comply with 404 years ago, when CFOs at larger companies and auditors were just getting their feet wet with the new law and regulators had yet to make it easier to comply by relaxing their guidance.

Like many finance executives who have gone through the process, Crow says his company has benefited from being fully 404-compliant, uncovering inefficiencies in some processes, including the cancellation of purchase orders. Moreover, says Crow, “it’s nice for our shareholders to know that we got an opinion from our auditors, whether or not we’re required to do so.”

Consultants and auditors who could use extra dollars from 404(b) reviews are mining for similar notes of enthusiasm. Protiviti, a risk-management and internal-audit consulting firm, recently released a survey of 400 executives — many of them longtime, fully compliant Sarbox veterans — with 70% of them claiming that the benefits of internal-control reviews outweigh the costs. (However, only a minority of first-time Sarbox compliers said the same.)

Companies have gained a better grasp of their controls and uncovered more efficient ways to do business, says Bob Hirth, executive vice president and leader of Protiviti’s global internal audit and financial control practice. But it’s unclear whether small-cap firms will believe such data. “Some companies will think, ‘Why not demonstrate beyond our own [management] reports that we have strong internal controls? Let’s move forward,'” he says. “Others never want to do it and will be glad they never have to do it.”

As a group, accounting firms have lobbied Congress to forgo the exemption. In a June letter to lawmakers working on the compromise version of the regulatory-reform bill, the Center for Audit Quality, which represents audit firms, and two investor trade groups insisted that an independent audit of internal controls provides “an important safeguard against financial fraud.” However, lawmakers who support the exemption, including Rep. John Adler (D-N.J.), claim it will preserve jobs and cut red tape for small businesses.

In the meantime, small businesses can wait out the decision. Since most of them have fiscal years concluding at the end of 2010, they have until early spring to submit an auditor review. Even auditors can understand small businesses’ tendency toward procrastination. “I can’t blame them if they’re waiting to see if this becomes law, since there have been so many deferrals,” says Stephen Austin, managing partner of Swenson Advisors, a regional accounting firm in California.