Abstract: An automated system and method is provided for conducting governance, risk management, and/or regulatory compliance audits within an organization. In embodiments, a regulatory compliance unit probes one or more computing devices on an organization's network in an attempt to identify non-compliant assets, including security vulnerabilities, unprotected or improperly-stored data, misconfiguration, outdated software, malware, missing or corrupted data, and the like. The disclosed system includes the capability to collect information from non-digital assets in an organization, including automatically conducting surveys among one or more persons within an organization to confirm such person's knowledge is in compliance with applicable requirements. The disclosed system also includes the ability to automatically discover target devices for further analysis. The regulatory compliance unit includes a data collection unit, a compliance scanning unit, a reporting unit, and a user console unit.