Big changes recommended after audit following Beijing fraud turns up anomalies.
A report has found Immigration New Zealand to be lacking in risk management governance after a lapse last year that led to 300 student visa applications with fraudulent documents being approved.
The audit, commissioned when the fraud was discovered at the department's Beijing branch, found the agency to be without a single governance body with oversight of its risk management framework and that risk processes were being implemented differently at various branches.
The PricewaterhouseCoopers study - released to the Herald under the Official Information Act - which looked at systems, structures and governance arrangements across Immigration NZ also found poor communication between divisions.
It made five recommendations, including establishing a new risk governance body, strengthening monitoring and reporting across all branches, and clarifying the role of the risk manager.
"There is no body that has overarching ownership and visibility of risk management and the associated controls," the report found. "Informal variations are made to processes without being sent to operational policy for review and approval."
It said existing governance bodies did not consider the framework from an overall perspective and looked only at limited aspects of the process.
Having one governance body responsible for setting and driving a consistent message to staff regarding the importance of risk management would let the agency "set the right tone from the top", the report said.
"Whilst it is understood that many of the front-line staff understand their local risk profile, it is important that this is put into a wider context."
Of the 245 Chinese students who entered New Zealand on the fraudulently obtained visas, more than 150 are still in the country unlawfully.
Immigration executive director Catriona McKay said the agency recognised "the underlying need" for a review of its risk management to keep pace with the "dynamic environment" it was operating in.
"The Immigration leadership team has already implemented some of the recommendations, including the establishment of a new risk governance body," she said.
"Other recommendations are longer term, but it is still envisaged that all recommendations can be implemented by the end of this year."
Last year, 68,980 international students were approved to study in New Zealand and 138,218 foreign nationals were granted a working visa.
Immigration officers are on the lookout for "doubtful bona fides" and since January, 14 Chinese students have been denied entry at the border and had their visas cancelled at the airport.
Kiwi Immigration Watch, an immigration watchdog group, said the report had found Immigration NZ "wanting" and "lacking in ability to fully manage risk".
"The blame is clearly on Immigration and they clearly haven't got the systems in place to fully vet all visa applications," said Allan Hughes, spokesperson for the group.
Mr Hughes, a former immigration compliance officer, said it was wrong for the agency now to be cancelling the visas which were issued because of its own "systems error".
"It is not right to be turning away valid student visa holders at the airport and all visas which have been issued should be honoured, at least until its expiry," he said.
Immigration Minister Michael Woodhouse said he was pleased the agency was seeking to improve its risk management framework, and expected the recommendations to be implemented without delay.