"There is no body that has overarching ownership and visibility of risk management and the associated controls," the report found. "Informal variations are made to processes without being sent to operational policy for review and approval."
It said existing governance bodies did not consider the framework from an overall perspective and looked only at limited aspects of the process.
Having one governance body responsible for setting and driving a consistent message to staff regarding the importance of risk management would let the agency "set the right tone from the top", the report said.
"Whilst it is understood that many of the front-line staff understand their local risk profile, it is important that this is put into a wider context."
Of the 245 Chinese students who entered New Zealand on the fraudulently obtained visas, more than 150 are still in the country unlawfully.
Immigration executive director Catriona McKay said the agency recognised "the underlying need" for a review of its risk management to keep pace with the "dynamic environment" it was operating in.
"The Immigration leadership team has already implemented some of the recommendations, including the establishment of a new risk governance body," she said.
"Other recommendations are longer term, but it is still envisaged that all recommendations can be implemented by the end of this year."
Last year, 68,980 international students were approved to study in New Zealand and 138,218 foreign nationals were granted a working visa.
Immigration officers are on the lookout for "doubtful bona fides" and since January, 14 Chinese students have been denied entry at the border and had their visas cancelled at the airport.
Kiwi Immigration Watch, an immigration watchdog group, said the report had found Immigration NZ "wanting" and "lacking in ability to fully manage risk".
"The blame is clearly on Immigration and they clearly haven't got the systems in place to fully vet all visa applications," said Allan Hughes, spokesperson for the group.
Mr Hughes, a former immigration compliance officer, said it was wrong for the agency now to be cancelling the visas which were issued because of its own "systems error".
"It is not right to be turning away valid student visa holders at the airport and all visas which have been issued should be honoured, at least until its expiry," he said.
Immigration Minister Michael Woodhouse said he was pleased the agency was seeking to improve its risk management framework, and expected the recommendations to be implemented without delay.