The Internet and E-Commerce
Infrastructure
The Internet and E-Commerce
Syllabus tag: KASNEB CPA | Foundation Level | CA16 Information Communication Technology | Topic 6 The Internet and E-Commerce
Lesson objectives
By the end of this topic, you will be able to:
- Distinguish the internet, an intranet and an extranet
- Describe the main e-commerce models
- Explain electronic payment systems and their controls
- Identify the risks of e-commerce and how they are managed
- Describe the accounting and tax implications of trading online
Why this matters
A business that sells online faces the same accounting questions as any other — when is revenue earned, who owes what, is the cash real — under conditions where the customer is unseen and the transaction is instant.
Internet, intranet, extranet
| Access | |
|---|---|
| Internet | Public and global |
| Intranet | Internal to one organisation |
| Extranet | Extended to named outsiders — suppliers, major customers |
An extranet is the interesting one for an accountant: it lets a supplier see stock levels or a customer see their own account, which removes work from both sides. It also means outsiders are inside the perimeter, so access control becomes the whole of the security.
E-commerce models
| Model | Description |
|---|---|
| B2C | Business to consumer — online retail |
| B2B | Business to business — usually larger and more systematic |
| C2C | Consumer to consumer — marketplaces and auction sites |
| B2G | Business to government — procurement portals, tax filing |
| M-commerce | Transactions conducted on mobile devices |
M-commerce dominates in Kenya, where mobile money reaches far more people than card payment does. A system designed for card-based e-commerce elsewhere may fit the local market badly, and that is a commercial point as much as a technical one.
Electronic payment
- Mobile money — M-Pesa and equivalents; dominant in Kenya
- Card payment — credit and debit, through an acquiring bank
- Bank transfer and RTGS — larger amounts
- Digital wallets — balances held with a provider
- Cryptocurrency — accepted rarely; volatile and lightly regulated
Controls over online receipts matter more than the technology chosen:
- Reconcile the payment gateway to the bank and to the sales ledger daily. Three figures that should agree, and the reconciliation is the control.
- Never treat a payment notification as proof of receipt. A confirmation message can be forged; only the bank or gateway statement evidences the cash.
- Segregate the person who releases goods from the person who confirms payment.
- Match refunds and reversals to original transactions, since this is where fraud concentrates.
The second point is worth emphasising. A customer-supplied screenshot is not evidence of payment, and a business that releases goods on one is functionally extending unsecured credit to a stranger.
Risks of e-commerce
| Risk | Management |
|---|---|
| Payment fraud and chargebacks | Verification, transaction limits, monitoring |
| Data breach of customer records | Encryption, minimal retention, access control |
| Site unavailability | Hosting redundancy, monitoring |
| Disputes over delivery | Tracked despatch, clear terms |
| Reputational damage | Prompt response, transparent handling |
Only collect the data you need. Data never collected cannot be breached, and long-retained customer records are a liability rather than an asset once their commercial use has expired.
Accounting and tax implications
Revenue recognition follows control passing to the customer, not the moment payment is taken. A payment received before despatch is a contract liability, not revenue — the IFRS 15 point from CA23 in an online setting.
VAT applies to online sales as to any other. Digital services supplied from abroad and consumed in Kenya fall within specific rules, and the eTIMS requirement applies to electronic invoices as to paper ones.
Records must still be retained for the statutory period, in a form that can be produced. A system where records exist only inside a platform the company does not control is a compliance risk.
:::checkpoint An online retailer takes payment on 28 December and despatches the goods on 4 January. State how the transaction is treated in the accounts to 31 December, and give the reason. :::
Emerging technologies
Artificial intelligence and machine learning — pattern recognition applied to fraud detection, forecasting and document processing. The limitation matters: a model trained on past data reproduces past patterns, including past errors and biases.
Blockchain — a distributed ledger where entries, once recorded, cannot be altered without detection. Its accounting interest lies in that immutability, though few organisations need a distributed ledger to achieve what a well-controlled database already does.
Robotic process automation — software performing repetitive rule-based tasks such as reconciliations and data transfer. Suited to high-volume, stable, rule-driven work, and unsuited to anything requiring judgement.
Big data and analytics — very large datasets analysed for patterns. Characterised by volume, velocity and variety.
Internet of things — devices reporting data automatically, from meters to vehicle trackers.
The common caution: each of these produces output that looks authoritative, and each depends entirely on the data behind it. Garbage in, garbage out applies with more force, not less, when the processing is opaque — because the error is harder to see.
:::checkpoint A company adopts an AI tool that flags supplier invoices as potentially fraudulent. Identify two questions the finance director should ask before relying on its output. :::