HOLLANDER, Judge.
This case concerns a contract dispute between the State and a company that provided health care to prison inmates. The State, acting through the Division of Correction (“DOC”) of the Department of Public Safety and Correctional Services (“the Department”), appellant, had a contract with ARA Health Services, Inc., d/b/a Correctional Medical Systems (“CMS”), appellee, to provide medical care to inmates incarcerated in Maryland correctional facilities. At issue is CMS’s claim for reimbursement for the cost of AIDS medication. After the Board of Contract Appeals denied CMS’s contract claim, CMS sought review in the Circuit Court for Baltimore City. The court reversed, based on a contractual “modification by conduct,” and entered judgment in favor of CMS in the amount of $135,446.00. In its appeal, the Department presents the following questions for our consideration:
I. Did the Circuit Court exceed its authority when it rejected the Board of Contract Appeals’s factual finding that the parties’ conduct did not constitute a modification and substituted its own factual findings and judgment that the conduct did constitute a modification?
II. Does sovereign immunity bar an action based on an unwritten modification to a written contract when the contract and State regulations require that all modifications to the contract be in writing and approved by the Board of Public Works?
We conclude that the circuit court erred in finding that the parties’ conduct constituted a modification of the contract. We are also of the view that sovereign immunity bars appellee’s action. As we answer both questions in the affirmative, we shall reverse.
[450]*450
FACTUAL BACKGROUND
The DOC issued a “Request for Proposals” in September 1988, in which it solicited bids from contractors to provide health care services to Maryland prisoners. CMS was awarded Contract No. 8804-00 (“the Contract”), which the parties executed in November 1988. The Contract, effective January 1, 1989, divided CMS’s costs into four categories: (1) primary care; (2) secondary care services (“SCS”); (3) operating costs; and (4) management fee. “Secondary care services” included specialty care, such as obstetrics and radiology, as well as services to inmates hospitalized outside a correctional facility. The Contract also provided that “the cost for the medication AZT ... and the cost for any newly developed medication for AIDS ... shall be considered as a Secondary Care Services cost.... ”
The Contract specified the manner in which CMS’s fees were calculated. Pursuant to § 05.07.01.02.01 of the Contract, the base fee was calculated by multiplying the “average daily population” of prisoners by an agreed upon rate.1 In addition, to help defray CMS’s costs in furnishing certain high-cost medical services, the Contract also provided a mechanism for CMS to receive an “excess fee” based on these costs; under certain limited circumstances, the DOC was required to reimburse CMS for the cost of services in excess of the base payments otherwise due to CMS for SCS. Section .05.08.04.03 of the Contract provided:
The Division [of Correction] will reimburse the Contractor [CMS] for 100% of the price of eligible AIDS related, disaster related and major disturbance related hospital services costs. In order for hospital services costs to be considered eligible, all of the following conditions must be met:
[451]*451.05.08.04.03.01. The Contractor expends for all Secondary Care Services during the term of this contract more than the total of all payment due the Contractor by the Division for Secondary Care Services as stated in ATTACHMENT VI;
.02. The potentially eligible hospital services costs are not eligible for reimbursement under another part of this contract;
.03. The total amount of the potentially eligible hospital services costs does not exceed the overexpenditure incurred by the Contractor for Secondary Care Services during the term of this Contract.
.04. The potentially eligible hospital services costs were incurred either:
.05.08.04.03.04.A. In order to treat one or more inmates whose ailments were diagnosed by the hospital as being AIDS related, or
B. In order to treat one or more inmates whose injuries were not self-inflicted and which were sustained as a result of a physical assault during a major disturbance, or
C. In order to treat ten or more inmates as the result of a disaster.
(Emphasis supplied).
The upshot of these provisions is that CMS was entitled to excess compensation for “AIDS related, disaster related and major disturbance related hospital services,” if two conditions were met: (1) the total amount that CMS spent in providing SCS was greater than the amount that CMS was entitled to receive as a base fee; and (2) CMS was not entitled to receive reimbursement for the services under another provision of the Contract. If both of those conditions were met, then CMS would receive as an excess fee either the actual costs that it incurred in providing the special hospital services, or the difference between the total costs that CMS incurred in providing SCS and the amount that CMS was entitled to [452]*452receive as a base fee, whichever was smaller.2 But CMS was not entitled to any excess costs for AIDS medication furnished to inmates who were not hospitalized.
From January 1, 1989 to June 30, 1990, CMS sought, and the DOC paid, a total of $135,446.00 for AIDS medication provided to inmates in correctional facilities, i.e, who were not hospitalized. Subsequently, on April 1, 1991, the parties executed a written modification (“Modification H”) to their original Contract. The modification provided that, retroactive to July 1, 1990, the DOC would reimburse CMS for the costs of all AIDS medication that it provided, whether dispensed at a correctional facility or in a hospital setting. Consequently, AIDS medication was no longer part of the excess fee calculation; it was reimbursed on a dollar-for-dollar basis. But, as the modification only applied retroactively to July 1, 1990, it had no bearing on the monies paid for AIDS medication dispensed to non-hospitalized prisoners during the initial eighteen month period.
In late 1991, these initial AIDS payments caught the eyes of auditors with the Legislature’s Division of Audits. In a report issued in January 1992, the auditors recommended that the [453]*453DOC “recover” the funds paid to CMS for AIDS medication during the period from January 1, 1989 to June 30, 1990 dispensed at penal institutions. The, auditors concluded that CMS had been reimbursed for AIDS medication as part of the SCS payments. DOC officials initially disputed the auditors’ report; the DOC claimed that CMS and the DOC had contemplated from the beginning that the DOC would reimburse CMS for its expenses in providing AIDS medication “if the Secondary Care cap [were] reached,” that CMS had not improperly billed the DOC, that the $135,446.00 in disputed payments were in accord with the intent of the parties, and that AIDS medication was part of the secondary care costs under § 05.08.04.03 of the Contract. After legislative hearings at which the Department was severely criticized, the DOC reversed its position. The DOC then unilaterally deducted $135,446.00 from its payment to CMS when CMS submitted its invoice for April 1992.
Thereafter, CMS filed a claim with the Department for the amount withheld. When the Secretary of the Department denied the claim, CMS appealed to the Board of Contract Appeals (the “Board”), which also rejected CMS’s claim. The Board concluded that the language of the Contract was “plain and unambiguous” and did not entitle CMS to the reimbursement that it sought. It reasoned that the Contract provided a specific method for calculating CMS’s compensation, which did not include 100% reimbursement for all AIDS medication costs. The Board placed particular emphasis on the fact that Modification H, executed in 1991, provided for dollar-for-dollar reimbursement for AIDS medication costs retroactive only to July 1, 1990, rather than to the original date of the Contract. In the Board’s view, this established that the parties consciously chose to abide by the terms of the original Contract for the period in issue.
The circuit court reversed. Although it accepted the Board’s finding that the Contract was “plain and unambiguous” and did not, on its face, entitle CMS to reimbursement for all AIDS costs, it nevertheless concluded that, by course of conduct, the parties modified the Contract, entitling CMS to [454]*454an excess fee for all AIDS medication costs that it incurred, regardless of whether the medication was dispensed in a hospital or at a penal institution. The court relied on the fact that, for eighteen months, the DOC reimbursed CMS for all of its AIDS medication costs, and had defended its payments to the legislative auditors and the General Assembly’s oversight committee as warranted under the Contract. The court thus entered judgment in favor of CMS for $135,446.00.
DISCUSSION
I.
CMS contends that the Contract was modified by the parties’ conduct, so that it is entitled to payment for all the AIDS medication that it provided, regardless of the location at which it was dispensed.3 The Department denies that such a modification occurred, and contends that the circuit court exceeded its authority by substituting its own factual findings for those of the agency.
We focus initially on whether the circuit court properly adhered to the scope of its review when it reversed the Board’s decision. The Maryland Administrative Procedure Act, Md.Code Ann., State Gov’t Art. (“S.G.”), § 10-222(h)(3) [455]*455(Supp.1994) provides that, on a petition for review, the circuit court may reverse or modify an agency decision
if any substantial right of the petitioner may have been prejudiced because a finding, conclusion, or decision:
(i) is unconstitutional;
(ii) exceeds the statutory authority of the final decision maker;
(iii) results from an unlawful procedure;
(iv) is affected by any other error of law;
(v) is unsupported by competent, material, and substantial evidence in light of the entire record as submitted; or
(vi) is arbitrary or capricious.
Pursuant to S.G. § 12-222(h)(3)(iv), the circuit court determined that the Board committed an error of law warranting reversal. Although the court declined to disturb the agency’s finding that the original Contract was not ambiguous, the court determined that the Board nevertheless should have proceeded to decide whether a post-formation modification by conduct had occurred. The court concluded that, by failing to do so, the Board committed an error of law.
After the court concluded that the Board had committed an error of law by failing to consider the modification issue, it examined the record and made its own factual finding that a modification had, indeed, occurred. In this regard, the court erred. As we have noted, with respect to factual findings, the court’s scope of review is limited to determining whether the agency’s factual findings are supported by substantial evidence. See Anderson v. Department of Public Safety and Correctional Services, 330 Md. 187, 212, 623 A.2d 198 (1993) (in reviewing agency’s factual findings, “reviewing court’s ‘appraisal or evaluation must be of the agency’s fact-finding results and not an independent original estimate of or decision on the evidence’ ”). The circuit court is not permitted to make its own factual findings; this is a task committed to the agency alone. Board of Trustees of the Employees’ Re[456]*456tirement System of the City of Baltimore v. Novik, 87 Md. App. 308, 312, 589 A.2d 976 (1991), aff'd, 326 Md. 450, 605 A.2d 145 (1992). In view of our resolution of the sovereign immunity issue, however, we need not remand to the Board to address the factual question that the circuit court improperly resolved.
II.
A
Sovereign immunity is the common law doctrine that protects the State from suit without its consent. Davis v. State, 183 Md. 385, 393, 37 A.2d 880 (1944). See also Board of Howard Community College v. Ruff, 278 Md. 580, 584, 366 A.2d 360 (1976) (declining to abrogate sovereign immunity by judicial fiat); Jekofsky v. State Roads Commission, 264 Md. 471, 474, 287 A.2d 40 (1972) (same); Katz v. Washington Suburban Sanitary Commission, 284 Md. 503, 512-13, 397 A.2d 1027 (1979) (same). Therefore, absent a legislative waiver of immunity, suit does not lie against the State or any of its agencies. See Clea v. Mayor & City Council of Baltimore, 312 Md. 662, 670, 541 A.2d 1303 (1988); Maryland Port Administration v. I.T.O. Corp. of Baltimore, 40 Md.App. 697, 703-04, 395 A.2d 145 (1978), cert. denied, 284 Md. 745 (1979).
CMS contends that a waiver of the Department’s sovereign immunity may be found in S.G. § 12-201(a) (1993), which provides:
Except as otherwise expressly provided by a law of the State, the State, its officers, and its units may not raise the defense of sovereign immunity in a contract action, in a court of the State, based on a written contract that an official or employee executed for the State or 1 of its units while the official or employee was acting within the scope of the authority of the official or employee. >
(Emphasis supplied). The plain terms of S.G. § 12-201(a) require application of sovereign immunity unless (1) there is a “written contract” between the plaintiff and the State; (2) the [457]*457plaintiffs claim is “based on” that contract; and (3) the contract was executed by a State employee acting within the scope of his authority. We conclude that CMS’s claim against the Department is barred by sovereign immunity.
As a statute in derogation of common law, S.G. § 12-201(a) must be strictly construed. See Miles Laboratories, Inc. Cutter Lavoratories Division v. Doe, 315 Md. 704, 723-24, 556 A.2d 1107 (1989) (“repeal of the common law by implication is never favored”). Such a strict construction comports with the general rule that, since the General Assembly should not be deemed lightly to give away the State’s immunity, statutory exceptions to sovereign immunity must be narrowly construed. See, e.g., Harris v. State, 48 Ohio Misc. 27, 358 N.E.2d 639, 645 (Ohio Ct.C1.1976); Pinckney v. Jersey City, 140 N.J.Super. 96, 355 A.2d 214, 216 (Ct.Law Div.1976); Brown v. State Highway Commission, 206 Kan. 49, 476 P.2d 233, 234 (1970); Kleban v. Morris, 363 Mo. 7, 247 S.W.2d 832, 837 (1952); Harrison v. Wyoming Liquor Commission, 63 Wyo. 13,177 P.2d 397, 399 (1947); Dembrod v. State, 185 Misc. 1061, 58 N.Y.S.2d 490, 493 (Ct.Cl.1945); Los Angeles County v. Riley, 20 Cal.2d 652, 128 P.2d 537, 543 (Dist.Ct.App.1942). Cf. Katz v. Washington Suburban Sanitary Commission, 284 Md. 503, 512, 397 A.2d 1027 (1979) (no waiver unless the Legislature provides for one clearly or by necessary and compelling implication).
CMS argues that its claim is founded on its original written Contract; it relies “on Contract No. 8804-00, as amended and modified.” CMS contends that the fact that it alleges a breach of the terms of the non-written, modified contract does not change the status of the written, original Contract as the “basis” for its claim.
In support of its assertion that its claim is predicated on the original Contract, as modified, and that sovereign immunity therefore does not apply, CMS relies on the case of Department of General Services v. Cherry Hill Sand & Gravel Co., 51 Md.App. 299, 443 A.2d 628 (1982). There, Cherry Hill contracted with the Department of General Services to per[458]*458form excavation work during the construction of a fish hatchery. Before Cherry Hill submitted its bid for the contract, an engineer, acting as an agent for the State, incorrectly told Cherry Hill’s president that there was sufficient “impervious fill” at the construction site to line the excavations. But Cherry Hill had to haul fill material from off-site locations to complete the lining process, thus incurring additional costs. In a breach of contract action, Cherry Hill sued the Department of General Services to recover its costs.
We rejected the State’s claim that Cherry Hill relied on an oral contract. Moreover, as the contract was not integrated, we concluded that the parol evidence rule did not bar admission of the State’s pre-contract oral representation as a “clarification” of the written contract. We concluded that Cherry Hill’s claim was based upon a written contract and thus its claim was not barred by sovereign immunity. We said: “The fact that [its] claim relies on an oral statement made during the bidding period to explain the contract does not transform that written contract into an oral contract.” Id., 51 Md.App. at 308, 443 A.2d 628 (emphasis supplied).
The focus in Cherry Hill was the application of the parol evidence rule, and not whether a contractual modification had occurred. The Court’s use of terms such as “explain” and “clarification” in reference to the engineer’s pre-contract oral statement illuminates quite plainly that, in Cherry Hill, there was only one contract—the written contract to perform the excavation work. The oral statement on which the company’s cause of action was based did not create a separate contract.
In contrast, appellant claims that the original Contract was modified by course of conduct. A modification creates a new contract. As the Court of Appeals said in Linz v. Schuck, 106 Md. 220, 234, 67 A. 286 (1907), a modification is “an abandonment of the original contract and a creation of a new contract.” See also L & L Corp. v. Ammendale Normal Institute, 248 Md. 380, 384, 236 A.2d 734 (1968) (meeting of the minds required to modify a contract); McKeever v. Washington Heights Realty Corp., 183 Md. 216, 220, 37 A.2d 305 [459]*459(1944) (same); 5A Maryland Law Encyclopedia Contracts § 232 at 355 (1982) (consideration required for modifications except in the case of contracts involving the sales of goods). Thus, unlike the situation in Cherry Hill, in the present case there are two contracts—the original written Contract, and the alleged implied contract that resulted from the parties’ course of dealings.
A breach of contract suit is “based on” a particular contract where that contract contains the terms whose breach is alleged. The trial court acknowledged that the terms of the original written Contract did not entitle CMS to relief. Moreover, CMS alleges breach of the terms of an implied contract formed by conduct after the execution of the written Contract. The claim is, therefore, manifestly “based on” this later contract. Thus, under the plain language of S.G. § 12-201(a), the State’s sovereign immunity has not been waived because CMS’s claim is not “based on a written contract.” As we stated in Mass Transit Administration v. Granite Construction Co., 57 Md.App. 766, 780, 471 A.2d 1121 (1984): “However meritorious a claim based on an implied contract may be, if that claim is against the State or any of its agencies, it is barred because it is not based upon a written contract.”
B
S.G. § 12-201(a) provides that, in order to avoid the bar of sovereign immunity, a contract claim against the State must be based on a written contract executed by a State employee “within the scope of [his] authority.” Appellant contends that CMS’s claim is barred by sovereign immunity because its officials who engaged in the conduct that allegedly modified its Contract with CMS had no authority to do so.
The lack of authority argument was not presented either to the Board or to the circuit court. Ordinarily, we will not consider issues that were not raised below. See Rule 8-131(a). But the issue of sovereign immunity may be raised for the first time on appeal, Foor v. Juvenile Services Administration, 78 Md.App. 151, 160, 552 A.2d 947, cert. denied, 316
[460]*460Md. 364, 558 A.2d 1206 (1989), because sovereign immunity may only be waived by an act of the Legislature or a constitutional amendment. Kee v. State Highway Administration, 313 Md. 445, 455, 545 A.2d 1312 (1988). It is not waived if executive branch officials simply give their consent to a particular suit, or if the State’s lawyers fail to plead it in their answer to a complaint. Board of Trustees of Howard Community College v. Ruff, 278 Md. 580, 583, 366 A.2d 360 (1976); Board of Education v. Alcrymat Corp., 258 Md. 508, 516, 266 A.2d 349 (1970). It follows that an additional argument in support of sovereign immunity may also be raised for the first time on appeal. Thus, we shall consider the merits of the Department’s contention.
The precise issue, to use the language of S.G. § 12-201(a), is whether Department officials were acting “within the scope of [their] authority” if they modified the Contract or created a new contract with CMS that superseded or supplemented the terms of the original Contract. Title 21 of the Code of Maryland Regulations (COMAR), which contains the regulations that govern State procurement, outlines the contours of the Department’s authority. COMAR § 21.01.03.02A generally makes the regulations applicable to “every expenditure by a State agency for the acquisition, rental, purchase, or lease of ... services....” COMAR § 21.03.01.01 provides also that “[a] State agency may not enter into a procurement contract except as permitted” under the regulations and the State Finance and Procurement Article of the Annotated Code of Maryland.
The Code and the regulations reveal that the Department has limited ability to enter large-scale contracts4 without the approval of supervisory agencies in the State government. Section 12—101(b)(1) of the State Finance and Procurement Article vests general control over State procurement in the [461]*461Board of Public Works. Section 10-204 authorizes the Board of Public Works to adopt regulations requiring the submission to it of any proposed State contract “for consideration and approval before execution.” Under this authority, the Board of Public Works has promulgated rules codified in Title 21 of COMAR, which govern the approval of contracts that the Department wants to enter.
COMAR § 21.02.01.04H provides a list of the types of contracts into which the Department may enter on its own initiative, without Board of Public Works approval; contracts for the provision of health care services are not included on this list. Therefore, such contracts fall within the ambit of COMAR § 21.02.01.05A(1), which provides that, with exceptions not pertinent here, “the Board [of Public Works] shall review and approve the award of those procurement contracts not delegated under this chapter [e.g., under sections such as COMAR § 21.02.01.04H, supra], before execution.” Additionally, COMAR § 21.02.01.05A(7) states that “the award of any procurement contract which must be submitted to the Board [of Public Works] for approval pursuant to this chapter may not take effect until it has been approved by the Board [of Public Works].” (Emphasis supplied).
This network of statutes and regulations makes it clear to us that neither the Department nor the DOC had authority to create the alleged “modification by conduct” of CMS’s written Contract. State regulations require submission of such a contract to the Board of Public Works for approval before it may take effect. No such approval was sought in this case. Rather, CMS alleges that conduct on the part of Department officials created a new or modified contract whose terms entitle CMS to the relief that it seeks. Since this contract did not pass through the required approval procedures, the officials lacked authority to create it.
This determination cannot end our analysis, however. S.G. § 12-201(a) (1993), does not waive the State’s sovereign immunity to claims based on written contracts which a State employee executed with “authority”; rather, it waives the [462]*462immunity if the employee executed the contract “within the scope of [his] authority.” (Emphasis supplied). The latter term is broader than the former one; “scope of authority” generally includes “not only actual authorization conferred upon [an] agent by his principal, but also that which has apparently or impliedly been delegated to [the] agent.” Black’s Law Dictionary at 1347 (6th ed. 1990). See also Penowa Coal Sales Co. v. Gibbs & Co., 199 Md. 114, 119, 85 A.2d 464 (1952) (as between a principal and third persons, the “scope” of the agent’s authority is governed by his apparent authority). While the statutes and regulations discussed above lead to the conclusion that the Department's officials lacked actual authority to create a new contract with appellee, the General Assembly’s use of the term “scope of ... authority” might arguably invite consideration of whether those officials had apparent authority to modify the Contract.
We conclude that, under common law, a State official’s “scope of authority” is co-extensive with his “actual authority.” We therefore construe the phrase “within the scope of the authority” in S.G. § 12-201(a) (1993), as incorporating this principle. Accordingly, the State is not bound by a contract executed by its officials or employees unless those persons had actual authority to execute it. See, e.g., Rustrum Realty, Inc. v. Commonwealth Dept. of Property and Supplies, 35 Pa.Cmwlth. 62, 384 A.2d 1043, 1046 (1978); Harris v. University of Akron, 46 Ohio Misc. 29, 346 N.E.2d 365, 366 (Ohio Ct.Cl.1975); Pacific Inter-Club Yacht Association v. Richards, 192 Cal.App.2d 616, 619, 13 Cal.Rptr. 730 (1961); Alexandropoulos v. State, 103 N.H. 456, 174 A.2d 417, 418 (1961); Lien v. Northwestern Engineering Co., 74 S.D. 476, 54 N.W.2d 472, 476 (1952); Appeal of Roadmix Construction Corp., 143 Neb. 425, 9 N.W.2d 741, 745 (1943); State v. Frame, 200 Okla. 650,199 P.2d 215, 217 (1948).
In the absence of actual authority, the State may avoid the contract, regardless of the reasonableness of the beliefs of the other party. Although no Maryland case has applied this rule in a case concerning a contract with the [463]*463State, the principle has been relied on many times in cases involving counties and municipal corporations. See, e.g., Gontrum v. City of Baltimore, 182 Md. 370, 375, 35 A.2d 128 (1943) (“A municipal corporation is not bound by a contract made in its name by one of its officers or by a person in its employ, although within the scope of its corporate powers, if the officer or employee had no authority to enter into such a contract on behalf of the corporation.”); State v. Kirkley, 29 Md. 85, 110 (1869) (“No principle of the law relating to municipal corporations is more firmly established than that those who deal with their agents or officers must, at their peril, take notice of the limits of the powers both of the municipality and of those who assume to act as its agents and officers.”); Tuxedo Cheverly Volunteer Fire Co., Inc. v. Prince George’s County, 39 Md. App. 322, 330, 385 A.2d 819 (1978) (“well-recognized general principle that a county or municipality can make a contract only in the manner prescribed by the legislature, and that if essential formalities are lacking, the contract is invalid and unenforceable”). Consequently, the notion of “apparent authority” need not be considered when a contract with the State is at issue.
Here, the Department could not have entered into an enforceable contract entitling CMS to reimbursement for AIDS medication dispensed at correctional facilities; any such contract was not created “within the scope of the authority” of the officials with whom CMS dealt. Therefore, S.G. § 12-201(a) (1993) does not abrogate the Department’s sovereign immunity protection, and CMS’s claim is necessarily barred.
CMS cites Leaf Co. v. Montgomery County, 70 Md.App. 170, 520 A.2d 732 (1987), for the proposition that a court may “balance the equities” in deciding whether to enforce an unauthorized contract with a governmental entity. Leaf Co. concerned a breach of contract claim against a county, and did not consider the issue of the State’s sovereign immunity. Cf Board of Education of Prince George’s County v. Mayor and Common Council of Town of Riverdale, 320 Md. 384, 389, 578 A.2d 207 (1990) (counties and municipalities do not have [464]*464immunity to breach of contract actions). But we must assume that the General Assembly balanced all of the pertinent equities when it enacted S.G. § 12-201(a). Since the contract that forms the basis of CMS’s claim is not in writing, and the Department officials who created it did not have the authority to create it, CMS’s claim is barred by sovereign immunity.
JUDGMENT REVERSED. COSTS TO BE PAID BY APPELLEE.