Closing a CAPA Isn't the Same as Fixing the Problem
Novo Nordisk just learned this the expensive way. Most of the industry already knows… and conveniently ignores.
The FDA's warning letter to Novo Nordisk Inc. landed in February 2025, and the headline writes itself: the maker of Ozempic® failed to report thousands of adverse events for one of the most-watched drugs on the market.
But the headline misses the point entirely.
What happened here wasn't a failure to notice the problem. NNI noticed the problem. In April 2024, they opened a deviation. They identified the root cause. They documented corrective actions. They assigned owners. They had a plan.
In December 2024, they closed the deviation.
Then FDA showed up, and found the same problem still running.
The CAPA Was Theater
Here's what closing that deviation meant: someone confirmed that the corrective actions had been implemented. Not that they had worked. Not that the failure mode was gone. Not that the cases generated during the gap had been remediated.
The box got checked. The problem did not get solved.
And here is the part that should make you uncomfortable, because it should:
This happens constantly. In every quality management system. In almost every regulated industry. At organizations that have won awards for their quality culture.
The CAPA system – the mechanism specifically designed to ensure problems get fixed – becomes, in practice, a documentation trail that proves you thought you fixed it. The corrective actions are completed. The closure is recorded. The deviation disappears from the open log. Everyone moves on.
The root cause does not move on.
This is not a Novo Nordisk problem. Novo Nordisk is just the one who got caught.
Their Own SOP Was the Violation
The specific failure is worth understanding, because it's almost elegant in how thoroughly it documents its own dysfunction.
According to the Warning Letter, NNI had a written procedure that allowed adverse event reports to be rejected if the reporter stated the event was unrelated to the product. FDA's requirement is that all adverse events get reported, whether or not anyone thinks they're drug-related. That determination belongs to FDA, not to the manufacturer's contract intake screener.
The procedure itself was noncompliant. Not a rogue employee. Not a bad day. The SOP. The document that was supposed to ensure compliance was the source of the violation… running quietly, generating unreported cases, for years.
When they switched pharmacovigilance contractors (which they did believing this would address the problem… read: the quick fix), the new contractor inherited the same noncompliant procedure. Same instructions. Same outputs. Same gap.
The contractor change looked like a corrective action…
It wasn't.
It was theater with a new cast.
The Contempt the Industry Has Earned
Let me be direct about something.
The CAPA-as-theater problem persists not because quality professionals don't know better. They know exactly what a properly closed corrective action looks like. They know the difference between "the action was implemented" and "the problem is gone." They have been trained on this. They have written SOPs about this. They have audited other organizations for this exact failure.
And then they go back to their own systems and close CAPAs the same way.
Because the pressure is to clear the log. Because the metric is open vs. closed. Because a deviation sitting open for eight months looks worse on a dashboard than a deviation closed on a technicality. Because the QMS, in most organizations, is optimized for the appearance of control, and not for evidence that control actually exists.
That is not a resource problem. And it is not a training problem.
It is a choice that gets made, quietly, every day, in quality departments that know better.
“It’s a business decision.”
Forgive me my lack of surprise that Novo Nordisk ended up here.
What Defensible Actually Looks Like
A corrective action is closed when the failure mode is gone. Not when the paperwork is complete. The distinction matters because FDA does not audit your paperwork… they audit your outcomes.
Verification that the fix worked. Not that it was implemented. That it produced different results. If the root cause was a noncompliant procedure, the verification is evidence that the procedure now produces compliant outputs, run forward in time, with documentation.
Lookback remediation. If the failure produced noncompliant outputs during the period it was active, closing the CAPA without addressing those outputs leaves the exposure open. NNI had unreported adverse events sitting in their system when they closed the deviation. FDA found them. They always find them.
Oversight of delegated functions. If a contractor executes a process that sits under your quality system, their procedure is your procedure. Switching contractors doesn't reset the clock. It just changes who is executing the same broken instructions.
The Novo Nordisk warning letter is worth reading not because of what they did wrong, but because of how thoroughly they documented doing it. The records are immaculate. The deviation was opened. The root cause was identified. The corrective actions were assigned. The closure was recorded. At every step, the quality system produced exactly the right paperwork.
The problem just didn't get fixed.
If your next inspection pulled your last five closed CAPAs — not to review whether they were documented correctly, but to verify whether the problems they addressed are actually gone — how many of them would hold up?
That question deserves an honest answer. Not the answer you'd give an auditor.
The actual answer.
Ron Brooks is a quality and compliance consultant for analytical, clinical, and specialty laboratories, including cannabis testing operations. He advises labs on building quality systems that are defensible under inspection — not just documented.
