There are basically two ways it is done:
In the Automatic method an Ethereum contract is provided which exposes a method that investors may call (passing in their investment in the form of Ether) in order to receive the promised tokens.
In the Manual method, the organizers of the ICO offer a registration process (usually via a web site) where an investor submits any required information. The investor is provided with addresses to which they may send their investment (in whatever form the ICO accepts, ETH, Bitcoin, USD... whatever).
The advantage of the Automatic method is that it is "trustless", meaning that you have the chance to review the contract before submitting your investment to be sure that you will receive the expected tokens. The downside is that currently these contracts can only accept payments in the form of ETH (or possibly other tokens that exist on the Ethereum blockchain).
The advantage of the Manual method is that payment can be made via multiple currency types, but the downside is that you are basically sending your money to unknown people and trusting them not to steal it.
Of course even with the Automatic method you are still placing a lot of trust in the organizers of the ICO because you are counting on them to run the business in a professional way, rather than just a quick way for them to make $$$.
Probably either way is fine, as long as the ICO organizers are trustworthy.