The first thing to check is that the closing event arrives and is logged in the nworks collector event log.
If the event is there, and matches the alert generating event, it is a good idea to pay attention to the time stamp. If both the alert generating event and the alert closing event arrive so quickly that they have the same time stamp in the event log, this is an issue with SCOM.
In SCOM SP1, it is a known issue that if the alert generating event and alert closing event have the same time stamp, the alert may not be closed automatically. There is no other option but to close it manually in this case.