How should IT Departments approach the App Store?

This question is in the capacity as an IT Administrator for a small/mid size company. We have 4 Macs, 8 iPads, and 3 iPhones. I have 1 Mac and 1 iPad at work that I use. 2 years ago we considered the options with how to support Apple ID accounts, iTunes, App Store, and the payment method(s) which need to be on-file.

Given our experience with accidental app and in-app purchases (according to the employees), the accounting department and the president decided after a conference call with Apple Support using Apple Care that rather than use corporate credit cards on file with corporate apple IDs, we would switch to a model that de-coupled the purchasing approval with installation approval. The old method required us to review the monthly corporate card accounts, then chase down the people to make sure proper purchasing approval had been sought prior to app or in-app purchase. There was no incentive for the employees seek prior approval even though one would expect professional adults to do so. Currently the company notes that it would take on average 8 weeks for an employee to reimburse the company for a recreational purchase.

The replacement system currently in use now is for all Apple IDs to be personal accounts with personal credit cards. Then employees are responsible for submitting an expense report and risk having the expense report request denied. The thinking was that this would curtail the accidental app or in-app purchases as the employee would risk not being reimbursed for an unapproved purchase. This system worked and accidental reimbursed purchases went down to zero for employees for whom this was a problem with corporate credit cards.

This is the model we use for iPads and iPhones. Up until now, all Mac software purchases were shink-wrap purchased online from Apple or via an Apple VAR. The push for the Mac to use the App Store changes this.

MY QUESTION IS: if I buy the Mac OS X 10.7 Lion or 10.8 Mountain Lion with my personal Apple ID, can I install it on the other company Macs? Will those users need to know my Apple ID password? Or does the OS install without needing the Apple ID password? What if a user needs me to install his or her OS on a company issued Mac, where he or she bought the OS under his or her Apple ID, can I install that OS without knowing his or her credentials? Also can I install my copy of the OS on that company Mac and would future OS updates run without having to give that end user my own Apple ID Password? Can I install the OS using my Apple ID then hand it off to him or her and let he or she run updates with his or her Apple ID? Does it work that way? We would rather not share passwords as each of our accounts has a personal credit card on file.

We would consider corporate Apple ID accounts if the following requirements can be implemented. All app or in-app purchases should fire off an event which goes first to the employee’s direct manager then next to the company’s controller for approval. If approved, then the app store or iTunes store should allow the end user to install the purchased item. All company purchases should be kept under NET30 terms, then invoiced at the end of the month and paid all at once. These are the requirements from our accounting department. This is how all of our other vendors (IBM, Microsoft, Oracle, etc.) are paid.

The App Store seems to exist in some new virtual reality which our accounting department and legal/policy.compliance departments cannot comprehend. I know IT Departments often get blamed for this, however, in our case that would just be shooting-the-messenger. I am just trying to understand how all of this should work. It would seem to me that this new consumer-cloud-model exists the way we have Apple IDs currently set up. The end-user interfaces with the App Store, then works directly with accounting to pay for the services. It doesn't seem like IT needs to be involved anymore. This is currently how we are attempting to approach this consumer cloud App Store model. The upside is it let's IT focus on projects which directly require our unique expertise rather than play App-Store-middlemen with no value-add.

You thoughts?